-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from the regular expression defined in InfoSvnCommand.lspattern, which is used to parse SVN repository info data. The regex contains multiple overlapping capture groups (e.g., .+? for author matching followed by optional size groups) and ambiguous space quantifiers (* and +) that can lead to exponential backtracking. When processing attacker-controlled input with excessive spaces (as demonstrated in the PoC), this causes polynomial/combinatorial regex complexity. The init method directly uses this regex for parsing, making both the regex definition and its usage point vulnerable. The code location and attack vector are explicitly referenced in multiple sources including GitHub advisories and NVD records.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| py | pip | <= 1.11.0 |
KEV Misses 88% of Exploited CVEs- Get the report