-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in the listNames(String regex) method, which is part of the ReadOnlyDataSource interface in the com.powsybl:powsybl-commons package. The core of the issue lies in the fact that this method directly compiles and executes a user-provided regular expression without any safeguards. An attacker can craft a malicious regex pattern that, when evaluated against a list of file names, causes the regex engine to enter a state of catastrophic backtracking. This leads to excessive CPU consumption and a denial of service.
The patch for this vulnerability replaces the direct use of Pattern.asPredicate() with a mechanism that evaluates the regex match with a timeout. This is done by moving the filtering logic to a new utility function, DataSourceUtils.listNames, which uses a Callable and a Future to enforce a timeout on the matching operation. This prevents a malicious regex from blocking the server indefinitely.
The primary vulnerable function is com.powsybl.commons.datasource.ReadOnlyDataSource.listNames because this is the API that developers use and that is exposed to potentially untrusted input. Any code that calls this method with a user-provided regex is at risk.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.powsybl:powsybl-commons | maven | <= 6.7.1 | 6.7.2 |