{"id":"PYSEC-2026-3906","summary":"Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching","details":"### Problem description\n\nProtego constructs regular expressions to match URLs against `robots.txt` `Allow:` and `Disallow:` directives, see `protego._urlpattern._URLPattern._prepare_pattern_for_regex()`. Every `*` in the directive value is translated into a lazy `.*?` regex piece, thus a specially crafted directive value with many asterisks may produce a regex that freezes the parser due to exponential backtracking.\n\n### Impact\n\nParsing a specially crafted `robots.txt` with `protego.Protego.parse()` and then trying to match an URL with `protego.Protego.can_fetch()` results in the latter call not returning for a period dependent on the length of the URL.\n\n### Proof of concept\n\n```python\nfrom protego import Protego\n\nrobotstxt = f\"\"\"\nUser-agent: *\nDisallow: /{\"*1\" * 12}*Z\n\"\"\"\nrp = Protego.parse(robotstxt)\nurl = \"/\" + \"1\" * 60\nrp.can_fetch(url, \"mybot\")  # freezes\n```","aliases":["CVE-2026-55520","GHSA-wjmf-p669-5m5p"],"modified":"2026-09-10T12:15:12.559484951Z","published":"2026-09-10T09:44:58.501183Z","references":[{"type":"WEB","url":"https://github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p"},{"type":"WEB","url":"https://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858"},{"type":"PACKAGE","url":"https://github.com/scrapy/protego"},{"type":"WEB","url":"https://github.com/scrapy/protego/releases/tag/0.6.2"},{"type":"PACKAGE","url":"https://pypi.org/project/protego"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wjmf-p669-5m5p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55520"}],"affected":[{"package":{"name":"protego","ecosystem":"PyPI","purl":"pkg:pypi/protego"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2"}]}],"versions":["0.1","0.1.12","0.1.14","0.1.15","0.1.16","0.1.dev0","0.2.0","0.2.1","0.3.0","0.3.1","0.4.0","0.5.0","0.6.0","0.6.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/protego/PYSEC-2026-3906.yaml"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}