CVE-2026-55520: Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

August 28, 2026

Parsing a specially crafted robots.txt with protego.Protego.parse() and then trying to match an URL with protego.Protego.can_fetch() results in the latter call not returning for a period dependent on the length of the URL.

References

github.com/advisories/GHSA-wjmf-p669-5m5p
github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858
github.com/scrapy/protego/releases/tag/0.6.2
github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p
nvd.nist.gov/vuln/detail/CVE-2026-55520

Code Behaviors & Features

Detect and mitigate CVE-2026-55520 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →