AIKIDO-2026-662826
colord is vulnerable to Regular Expression Denial of Service (ReDoS)
37
Low Risk
This Affects:
colordTL;DR
The CSS color-string parsers in colord use a numeric regular expression whose \d* and \d+ quantifiers can match the same digits, causing catastrophic backtracking. When the RGB, HSL, HWB, LCH, or CMYK string matchers reject an oversized malformed color string, rejection time grows. Because parsing runs synchronously and cannot be interrupted, a large crafted color string reaching functions such as colord(), getFormat(), isEqual(), mix(), or contrast() blocks the thread and stalls the application. The fix rewrites the numeric pattern so each input has only one matching strategy, restoring linear-time rejection.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass untrusted color strings to colord's parsing functions.
Background info
colord is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 0.0.1 - 2.9.3.
How to fix this
Upgrade the colord library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant