Skip to content

configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to quadratic backtracking #146333

Closed
Closed
configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to quadratic backtracking#146333
Labels
stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-securityA security issue

Description

@StanFromIreland
StanFromIreland
opened on Mar 23, 2026

Bug report

Bug description:

Found by OSS Fuzz in #461069020.

The below reproducer:

import configparser
import time

for N in (10000, 20000, 30000, 40000):
    cfg = (
        "[section]" +
        "\n" + "x" + " " * N + "y" + "\n"
    )
    parser = configparser.RawConfigParser()
    s = time.perf_counter()
    try: parser.read_string(cfg)
    except: pass
    t = time.perf_counter() - s
    print(f"{N}  {t}")

reveals the quadratic behaviour:

10000  0.5478692570177373
20000  2.175520057004178
30000  4.97204191898345
40000  8.673784376995172

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

Activity

  1. StanFromIreland
    added
    type-bugAn unexpected behavior, bug, or error
    stdlibStandard Library Python modules in the Lib/ directory
    on Mar 23, 2026
  2. vstinner
    added
    type-securityA security issue
    on Mar 24, 2026
  3. joshuaswanson
    added 3 commits that reference this issue on Mar 25, 2026

    pythongh-146333: Fix quadratic regex backtracking in configparser opt…

    12c55b1

    pythongh-146333: Fix quadratic regex backtracking in configparser opt…

    fe7efda

    pythongh-146333: Fix quadratic regex backtracking in configparser opt…

    85407ee
  4. encukou
    added a commit that references this issue on Apr 7, 2026

    gh-146333: Fix quadratic regex backtracking in configparser option pa…

    7e0a0be
  5. miss-islington
    added a commit that references this issue on Apr 9, 2026

    pythongh-146333: Fix quadratic regex backtracking in configparser opt…

    ab8704a
  6. mandree
    added 4 commits that reference this issue on Apr 11, 2026

    lang/python314: security update to 3.14.4

    b526f87

    security/vuxml: add two more python vulns

    ef39fbd

    lang/python314: security update to 3.14.4

    62a66cb

    security/vuxml: add two more python vulns

    16aa19e
  7. gpshead
    added a commit that references this issue on Apr 12, 2026

    [3.14] gh-146333: Fix quadratic regex backtracking in configparser op…

    af2f518
  8. freebsd-git
    added 2 commits that reference this issue on Apr 12, 2026

    lang/python314: Security update to 3.14.4

    955268b

    lang/python314: Security update to 3.14.4

    cb35b3d
  9. encukou
    added 2 commits that reference this issue on Apr 14, 2026

    [3.13] pythongh-146333: Fix quadratic regex backtracking in configpar…

    c4fcd9c

    [3.13] gh-146333: Fix quadratic regex backtracking in configparser op…

    a5969e8
  10. ljfp
    added a commit that references this issue on Apr 25, 2026

    pythongh-146333: Fix quadratic regex backtracking in configparser opt…

    2203231
  11. camachat
    added 2 commits that reference this issue on Jul 22, 2026

    lang/python314: Security update to 3.14.4

    7b1d556

    lang/python314: Security update to 3.14.4

    ec484f0
  12. Yhg1s
    added a commit that references this issue on Aug 4, 2026

    [3.12] gh-146333: Fix quadratic regex backtracking in configparser op…

    5755830
  13. pablogsal
    added 2 commits that reference this issue on Aug 10, 2026

    [3.11] gh-146333: Fix quadratic regex backtracking in configparser op…

    77bcd02

    [3.10] gh-146333: Fix quadratic regex backtracking in configparser op…

    0e14e5d
  14. StanFromIreland
    closed this as completedon Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-securityA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions