CVE-2026-85062 Details

A denial-of-service vulnerability has been identified in Colord versions prior to 2.9.4. The issue arises in the synchronous CSS color string matchers of the RGB, HSL, HWB, LCH, and CMYK color models. These matchers use an ambiguous numeric regular expression that allows the same digits to be split between overlapping quantifiers in a way that increases processing time quadratically. This flaw can be exploited by an attacker who sends a long, malformed color string to certain Colord functions, such as colord(), getFormat(), isEqual(), mix(), or contrast. The vulnerability can be triggered through a request body, JSON field, or uploaded stylesheet, leading to significant delays in processing by blocking the thread with a multi-kilobyte payload.

Users can update to Colord version 2.9.4 or later, where this vulnerability has been fixed. The patch involves changing the regular expression to eliminate the ambiguity, allowing for proper validation of color strings without the risk of creating a denial-of-service condition.