CVE-2026-55520

Protego before 0.6.2 contains a regular-expression denial-of-service flaw: the _prepare_pattern_for_regex routine in src/protego/_urlpattern.py translates every asterisk in an Allow or Disallow directive into a lazy regex wildcard, so a directive containing many asterisks causes exponential backtracking in the _URLPattern match logic. An attacker who controls the robots.txt served by a site being crawled can craft such a directive, and after the crawler parses it with Protego.parse, a call to Protego.can_fetch on a near-miss URL can take an attacker-controlled amount of time to complete. The attacker gains denial of service against the crawler (CPU-bound stalls that can hang or slow a crawl), with no confidentiality or integrity impact, reflected in the CVSS 4.0 score of 7.1 with High impact to availability only. Anyone running a crawler that uses a vulnerable Protego version to fetch robots.txt from third-party or attacker-influenced sites is affected, including Python crawling frameworks that bundle protego as their robots.txt parser. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS currently estimates a 0.4% probability of exploitation within 30 days.

What to do: Upgrade protego to 0.6.2 or later (e.g., pip install -U 'protego>=0.6.2') in every crawler environment, and verify the resolved version with pip show protego, since other packages may pin older versions. As an interim mitigation, avoid crawling untrusted or user-submitted domains, bound robots.txt size/complexity, and enforce per-request timeouts so a stalled can_fetch() call cannot hang crawl workers.