CVE-2025-48059

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48059
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48059.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48059
Aliases
Published
2025-06-20T16:50:35Z
Modified
2026-10-21T09:15:58Z
Severity
  • 2.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion
Details

PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and com.powsybl:powsybl-contingency-api versions 5.0.0 to before 6.3.0, there is a a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the RegexCriterion class. This class compiles and evaluates an unvalidated, user-supplied regular expression against the identifier of an Identifiable object via Pattern.compile(regex).matcher(id).find(). If successfully exploited, a malicious actor can cause significant CPU exhaustion through repeated or recursive filter(...) calls — especially if performed over large network models or filtering operations. This issue has been patched in com.powsybl:powsybl-iidm-criteria 6.7.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1333"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48059.json"
}
References

Affected packages

Git / github.com/powsybl/powsybl-core

Affected ranges

Type
GIT
Repo
https://github.com/powsybl/powsybl-core
Events
Introduced
a2f1f99612dcece3d50f8f8c4a488e5951363e0a
Fixed
4fa8b7d8b7138489b8904bfa4620eae0d74378e7
Introduced
d456d23cd8e49fc5b0ee44ef58fce171b7527ef5
Fixed
a2f1f99612dcece3d50f8f8c4a488e5951363e0a
Fixed
d8398f689a5ccd505bd62eee2bd6670a29133110
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "6.3.0"
                },
                {
                    "fixed":  "6.7.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "5.0.0"
                },
                {
                    "fixed":  "6.3.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "d8398f689a5ccd505bd62eee2bd6670a29133110"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v6.7.2",
            "range":  [
                {
                    "fixed":  "4fa8b7d8b7138489b8904bfa4620eae0d74378e7"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48059.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "2263101914776199547147102013151043847",
                "309528258996381667948925265751661836521",
                "301052750063327292889939708774294173509",
                "175777541915428585007807339608930706130"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-48059-30c4d4db",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/powsybl/powsybl-core/commit/d8398f689a5ccd505bd62eee2bd6670a29133110",
        "target":  {
            "file":  "iidm/iidm-criteria/src/main/java/com/powsybl/iidm/criteria/RegexCriterion.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T09:15:58Z"