GCVE-110-VULN-PYPI-2026-000587

guardana-core reads the WWW-Authenticate header a probed MCP server returns with the regular expression _mcp_authorization._CHALLENGE_PARAM, (\w+)\s*=\s*"([^"]*)", through challenge_parameters when the discovery step of an MCP target probe looks for the resource_metadata parameter (_resource_metadata_urls). On a run of word characters with no ="..." after it, findall retries the match from every position, so the time to read the header grows with the square of its length, up to the 64 KiB header line that http.client accepts. The server under test, or anything that can answer for it, can stall the probe with one crafted header. Only availability is affected: a probe that finishes reads the same parameters. Affects 0.13.0 through 1.0.0rc5. Version 1.0.0 lets a parameter start only at a word boundary and makes the quantifiers possessive, so the header is read in linear time.