Low, CVSS 2.7MavenPublished
PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion
CVE-2025-48059 · GHSA-8qjw-9xgm-c9ff
- Affected
- Maven com.powsybl:powsybl-iidm-criteria >= 6.3.0, <= 6.7.1
- Fixed in
- 6.7.2· Vendor fix available
- Issue
- Impact What kind of vulnerability is it? Who is impacted? This is an advisory for a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the RegexCriterion class. This class compiles and evaluates an unvalidated, user-supplied regular expression against the identifier of an Identifiable object via Pattern.compile(regex).matcher(id).find(). To trigger polynomial ReDoS in RegexCriterion, two attacker-controlled conditions must be met: - Control over the regex input passed into the constructor: - Example: An attacker supplies a malicious pattern such as (.a){10000}. - Control or influence over the output of Identifiable.getId(): - Example: A long string like "aaaa...!" that forces excessive backtracking. If both conditions are satisfied, a malicious actor can cause significant CPU exhaustion through repeated or recursive filter(...) calls — especially if performed over large network models or filtering operations. While this class does not handle file or…
Recommended action: Upgrade to 6.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.