CVE-2025-48059

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-48059
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48059.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48059
Aliases
Published
2025-06-20T17:15:40Z
Modified
2025-06-27T11:02:01.317773Z
Summary
[none]
Details

PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and com.powsybl:powsybl-contingency-api versions 5.0.0 to before 6.3.0, there is a a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the RegexCriterion class. This class compiles and evaluates an unvalidated, user-supplied regular expression against the identifier of an Identifiable object via Pattern.compile(regex).matcher(id).find(). If successfully exploited, a malicious actor can cause significant CPU exhaustion through repeated or recursive filter(...) calls — especially if performed over large network models or filtering operations. This issue has been patched in com.powsybl:powsybl-iidm-criteria 6.7.2.

References

Affected packages

Git / github.com/powsybl/powsybl-core

Affected ranges

Type
GIT
Repo
https://github.com/powsybl/powsybl-core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

v1.*

v1.1.0

v2.*

v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0

v3.*

v3.0.0
v3.3.0-RC1
v3.5.0-RC1
v3.7.0-RC1
v3.8.0-RC1

v4.*

v4.0.0-RC1
v4.1.0-RC1
v4.10.0-RC1
v4.2.0-RC1
v4.4.0-RC1
v4.5.0-RC1
v4.6.0-RC1
v4.7.0-RC1
v4.8.0-RC1
v4.9.0-RC1

v5.*

v5.0.0-RC1
v5.1.0-RC1
v5.2.0-RC1
v5.3.0

v6.*

v6.0.0-RC1
v6.1.0
v6.2.0-RC1
v6.3.0
v6.4.0-RC1
v6.5.0-RC1
v6.6.0-RC1
v6.7.0
v6.7.0-RC1
v6.7.1