Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

protego

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1PyPIPublished

    Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

    CVE-2026-55520 · GHSA-wjmf-p669-5m5p

    Affected
    • PyPI protego <= 0.6.1
    Fixed in
    0.6.2· Vendor fix available
    Issue
    Problem description Protego constructs regular expressions to match URLs against robots.txt Allow: and Disallow: directives, see protego.urlpattern.URLPattern.preparepatternforregex(). Every in the directive value is translated into a lazy .? regex piece, thus a specially crafted directive value with many asterisks may produce a regex that freezes the parser due to exponential backtracking. Impact Parsing a specially crafted robots.txt with protego.Protego.parse() and then trying to match an URL with protego.Protego.canfetch() results in the latter call not returning for a period dependent on the length of the URL. Proof of concept

    Recommended action: Upgrade to 0.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →