CVE-2025-48058
BaseFortify
Publication date: 2025-06-20
Last updated on: 2025-06-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1333 | The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-48058 is a Polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl project's DataSource mechanism. It occurs when the listNames(String regex) method evaluates a user-supplied regular expression against file or resource names. A malicious actor can craft a regex pattern that causes excessive backtracking during matching, leading to significant CPU consumption and degraded server performance. This happens because the regex engine processes certain patterns with polynomial complexity, especially when combined with specific filenames. The vulnerability requires control over both the regex input and the filenames being matched. It was fixed in version 6.7.2 of com.powsybl:powsybl-commons. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can cause significant CPU consumption on the affected system, leading to degraded server performance and reduced availability. In multi-tenant environments, this can impact other users by delaying legitimate operations and potentially giving attackers a competitive advantage. The attack exploits regex backtracking to consume resources, which can result in denial of service conditions. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusually high CPU usage caused by regex backtracking in the PowSyBl DataSource mechanism, specifically when the listNames(String regex) method is called with untrusted regex patterns. Detection involves identifying calls to this method with user-supplied regex inputs and observing resource names that cause excessive backtracking. There are no specific commands provided, but monitoring CPU usage and logging regex inputs to listNames could help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the com.powsybl:powsybl-commons package to version 6.7.2 or later, where the vulnerability is patched. The fix replaces Java's standard regex engine with Google's re2j library, which prevents polynomial-time regex evaluation and thus mitigates the ReDoS risk. Additionally, avoid passing untrusted regular expressions to the listNames(String regex) method and restrict untrusted users from modifying filenames in the underlying data sources. [1, 2]