https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 05:01:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-245180 EUVD-2026-245180 https://cve.radiocsirt.org/vuln/euvd-2026-245180 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48058 <p>PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl&#39;s DataSource mechanism. If successfully exploited, a malicious actor can cause significant CPU consumption due to regex backtracking — even with polynomial patterns. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.</p> <p>PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, there is a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl&#39;s DataSource mechanism. If successfully exploited, a malicious actor can cause significant CPU consumption due to regex backtracking — even with polynomial patterns. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-48058 https://cve.radiocsirt.org/vuln/ghsa-rqpx-f6rc-7hm5 <p><strong>Affected:</strong> Maven: com.powsybl:powsybl-commons</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>This is an advisory for a **potential polynomial Regular Expression Denial of Service (ReDoS)** vulnerability in the PowSyBl&#39;s DataSource mechanism. When the `listNames(String regex)` method is called on a DataSource, the user-supplied regular expression (which may be unvalidated) is compiled and evaluated against a collection of file-like resource names.</p> <p>To trigger a **polynomial ReDoS** via this mechanism, **two attacker-controlled conditions** must be met: - **Control over the regex input** passed into `listNames(String regex)`. - _Example:_ An attacker supplies a malicious pattern like `(.*a){10000}`. - **Control or influence over the file/resource names** being matched. - _Example:_ Filenames such as `&#34;aaaa...!&#34;` that induce regex engine backtracking.</p> <p>If both conditions are satisfied, a malicious actor can cause **significant CPU consumption** due to regex backtracking — even with polynomial patterns. Since both inputs can be controlled via a publicly accessible method or external filesystem handling, the `listNames(String regex)` method is considered vulnerable to polynomial **REDoS**.</p> <p>Unlike classic _catastrophic exponential_ ReDoS, this subtle attack exploits a greedy `.*` prefix followed by a fixed suffix, repeated multiple times. When applied to long filenames that almost match the pattern, the regex engine performs extensive backtracking, degrading performance predictably with input size. In…</p> <p><strong>Affected:</strong> Maven: com.powsybl:powsybl-commons</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>This is an advisory for a **potential polynomial Regular Expression Denial of Service (ReDoS)** vulnerability in the PowSyBl&#39;s DataSource mechanism. When the `listNames(String regex)` method is called on a DataSource, the user-supplied regular expression (which may be unvalidated) is compiled and evaluated against a collection of file-like resource names.</p> <p>To trigger a **polynomial ReDoS** via this mechanism, **two attacker-controlled conditions** must be met: - **Control over the regex input** passed into `listNames(String regex)`. - _Example:_ An attacker supplies a malicious pattern like `(.*a){10000}`. - **Control or influence over the file/resource names** being matched. - _Example:_ Filenames such as `&#34;aaaa...!&#34;` that induce regex engine backtracking.</p> <p>If both conditions are satisfied, a malicious actor can cause **significant CPU consumption** due to regex backtracking — even with polynomial patterns. Since both inputs can be controlled via a publicly accessible method or external filesystem handling, the `listNames(String regex)` method is considered vulnerable to polynomial **REDoS**.</p> <p>Unlike classic _catastrophic exponential_ ReDoS, this subtle attack exploits a greedy `.*` prefix followed by a fixed suffix, repeated multiple times. When applied to long filenames that almost match the pattern, the regex engine performs extensive backtracking, degrading performance predictably with input size. In…</p> https://cve.radiocsirt.org/vuln/ghsa-rqpx-f6rc-7hm5