THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-wjmf-p669-5m5p (high) — Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

[GHSA] GHSA-wjmf-p669-5m5p (high) — Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

medgithub_advisoriesPublished 2026-08-28

GHSA-wjmf-p669-5m5p Severity: high CVE: CVE-2026-55520

Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

### Problem description

Protego constructs regular expressions to match URLs against `robots.txt` `Allow:` and `Disallow:` directives, see `protego._urlpattern._URLPattern._prepare_pattern_for_regex()`. Every `*` in the directive value is translated into a lazy `

Indicators of compromise

CVE-2026-55520cve

Original source: https://github.com/advisories/GHSA-wjmf-p669-5m5p