Vulnerability-Lookup

CVE-2026-85062 (GCVE-0-2026-85062)

Vulnerability from cvelistv5 – Published: 2026-09-03 20:30 – Updated: 2026-09-09 17:45

Title

Colord: Slow rejection of oversized malformed color strings

Summary

Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 17:45 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/omgovich/colord/security/advis…	x_refsource_CONFIRM
https://github.com/omgovich/colord/pull/141	x_refsource_MISC
https://github.com/omgovich/colord/commit/8701808…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
omgovich	colord	Affected: < 2.9.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T17:45:49.335799Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T17:45:56.584Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "colord",
          "vendor": "omgovich",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\\d*.?\\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T20:30:12.768Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv"
        },
        {
          "name": "https://github.com/omgovich/colord/pull/141",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/omgovich/colord/pull/141"
        },
        {
          "name": "https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2"
        }
      ],
      "source": {
        "advisory": "GHSA-2wm5-q62r-hmrv",
        "discovery": "UNKNOWN"
      },
      "title": "Colord: Slow rejection of oversized malformed color strings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-85062",
    "datePublished": "2026-09-03T20:30:12.768Z",
    "dateReserved": "2026-09-02T21:21:01.774Z",
    "dateUpdated": "2026-09-09T17:45:56.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-85062",
      "date": "2026-09-14",
      "epss": "0.00291",
      "percentile": "0.21614"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-09T01:46:01.000Z",
      "cve": "CVE-2026-85062",
      "id": "msrc_CVE-2026-85062",
      "initial_release_date": "2026-09-05T01:24:45.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Colord: Slow rejection of oversized malformed color strings",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-85062.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-85062\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-03T21:17:23.477\",\"lastModified\":\"2026-09-09T21:09:13.080\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\\\\d*.?\\\\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"omgovich\",\"product\":\"colord\",\"versions\":[{\"version\":\"\u003c 2.9.4\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-09T17:45:49.335799Z\",\"id\":\"CVE-2026-85062\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1333\"}]}],\"references\":[{\"url\":\"https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/omgovich/colord/pull/141\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-04T16:49:06+00:00",
      "cve": "CVE-2026-85062",
      "id": "CVE-2026-85062",
      "initial_release_date": "2026-09-03T20:30:12.768000+00:00",
      "product_status:known_affected": "57",
      "product_status:known_not_affected": "4",
      "product_status:under_investigation": "30",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "colord: omgovich/colord: Colord: Denial of Service via oversized malformed color strings",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85062.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-85062\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-09T17:45:49.335799Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-09T17:45:53.303Z\"}}], \"cna\": {\"title\": \"Colord: Slow rejection of oversized malformed color strings\", \"source\": {\"advisory\": \"GHSA-2wm5-q62r-hmrv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"omgovich\", \"product\": \"colord\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.9.4\"}]}], \"references\": [{\"url\": \"https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv\", \"name\": \"https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/omgovich/colord/pull/141\", \"name\": \"https://github.com/omgovich/colord/pull/141\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2\", \"name\": \"https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\\\\d*.?\\\\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1333\", \"description\": \"CWE-1333: Inefficient Regular Expression Complexity\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-03T20:30:12.768Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-85062\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-09T17:45:56.584Z\", \"dateReserved\": \"2026-09-02T21:21:01.774Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-03T20:30:12.768Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-85062

Vulnerability from fkie_nvd - Published: 2026-09-03 21:17 - Updated: 2026-09-09 21:09

Severity

6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2
	security-advisories@github.com	https://github.com/omgovich/colord/pull/141
	security-advisories@github.com	https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "colord",
          "vendor": "omgovich",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\\d*.?\\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4."
    }
  ],
  "id": "CVE-2026-85062",
  "lastModified": "2026-09-09T21:09:13.080",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-85062",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-09T17:45:49.335799Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-03T21:17:23.477",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omgovich/colord/pull/141"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2WM5-Q62R-HMRV

Vulnerability from github – Published: 2026-09-08 20:51 – Updated: 2026-09-08 20:51

Summary

Colord: Slow rejection of oversized malformed color strings

Details

Impact

colord's CSS color string matchers described a number as ([+-]?\d*\.?\d+). In that form \d* and \d+ can match the same digits, so a run of n digits can be divided between them in O(n²) ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long malformed color string blocks the thread:

input	time to reject
16 KB	224 ms
64 KB	4.4 s
128 KB	18.5 s

Reachable through colord() and getFormat(), and through any method that accepts a color string — including isEqual(), mix() and contrast(). The affected matchers are parseRgbaString and parseHslaString (built in) and parseHwbaString, parseLchaString, parseCmykaString (plugins).

Growth is polynomial, not exponential — multi-kilobyte payloads are required for a noticeable stall.

Who is affected

Applications that pass attacker-controlled strings of unbounded length to colord() — for example a server validating a color taken from a request body, JSON field, or uploaded stylesheet. colord applies no length limit before matching.

Typical client-side use with short input is not meaningfully affected.

Patches

Fixed in 2.9.4. The number is now written as ([+-]?(?:\d*\.\d+|\d+)), which accepts exactly the same syntax but leaves only one way to match it, making rejection linear — 1 MB of input is rejected in ~5 ms.

Workarounds

Reject or truncate color strings longer than a sane limit (e.g. 100 characters) before passing them to colord.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "colord"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-85062"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T20:51:57Z",
    "nvd_published_at": "2026-09-03T21:17:23Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\n`colord`\u0027s CSS color string matchers described a number as `([+-]?\\d*\\.?\\d+)`. In that form `\\d*` and `\\d+` can match the same digits, so a run of *n* digits can be divided between them in O(n\u00b2) ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long malformed color string blocks the thread:\n\n| input | time to reject |\n| --- | --- |\n| 16 KB | 224 ms |\n| 64 KB | 4.4 s |\n| 128 KB | 18.5 s |\n\nReachable through `colord()` and `getFormat()`, and through any method that accepts a color string \u2014 including `isEqual()`, `mix()` and `contrast()`. The affected matchers are `parseRgbaString` and `parseHslaString` (built in) and `parseHwbaString`, `parseLchaString`, `parseCmykaString` (plugins).\n\nGrowth is polynomial, not exponential \u2014 multi-kilobyte payloads are required for a noticeable stall.\n\n### Who is affected\n\nApplications that pass attacker-controlled strings of unbounded length to `colord()` \u2014 for example a server validating a color taken from a request body, JSON field, or uploaded stylesheet. `colord` applies no length limit before matching.\n\nTypical client-side use with short input is not meaningfully affected.\n\n### Patches\n\nFixed in **2.9.4**. The number is now written as `([+-]?(?:\\d*\\.\\d+|\\d+))`, which accepts exactly the same syntax but leaves only one way to match it, making rejection linear \u2014 1 MB of input is rejected in ~5 ms.\n\n### Workarounds\n\nReject or truncate color strings longer than a sane limit (e.g. 100 characters) before passing them to `colord`.",
  "id": "GHSA-2wm5-q62r-hmrv",
  "modified": "2026-09-08T20:51:57Z",
  "published": "2026-09-08T20:51:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/omgovich/colord/security/advisories/GHSA-2wm5-q62r-hmrv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85062"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omgovich/colord/pull/141"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omgovich/colord/commit/87018089515ed66a85b1a95c3c7c3fd69a25bac2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/omgovich/colord"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Colord: Slow rejection of oversized malformed color strings"
}

MSRC_CVE-2026-85062

Vulnerability from csaf_microsoft - Published: 2026-09-05 01:24 - Updated: 2026-09-09 01:46

Summary

Colord: Slow rejection of oversized malformed color strings

Scope

1 vulnerability in this advisory, including CVE-2026-85062.

CVE-2026-85062

Known not affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-85062 (GCVE-0-2026-85062)

FKIE_CVE-2026-85062

GHSA-2WM5-Q62R-HMRV

Impact

Who is affected

Patches

Workarounds

MSRC_CVE-2026-85062

Tags

Sightings

Nomenclature