[GHSA] GHSA-2wm5-q62r-hmrv (medium) — Colord: Slow rejection of oversized malformed color strings

GHSA-2wm5-q62r-hmrv Severity: medium CVE: CVE-2026-85062

Colord: Slow rejection of oversized malformed color strings

### Impact

`colord`'s CSS color string matchers described a number as `([+-]?\d*\.?\d+)`. In that form `\d*` and `\d+` can match the same digits, so a run of *n* digits can be divided between them in O(n²) ways, and rejecting an input retries every division. Parsing is synchronou