{"uuid": "1c284cd1-b2b4-4455-82d2-dacc4df0ecc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-48059", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/19003", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-48059\n\ud83d\udd25 CVSS Score: 2.7 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U)\n\ud83d\udd39 Description: PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and com.powsybl:powsybl-contingency-api versions 5.0.0 to before 6.3.0, there is a a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the RegexCriterion class. This class compiles and evaluates an unvalidated, user-supplied regular expression against the identifier of an Identifiable object via Pattern.compile(regex).matcher(id).find(). If successfully exploited, a malicious actor can cause significant CPU exhaustion through repeated or recursive filter(...) calls \u2014 especially if performed over large network models or filtering operations. This issue has been patched in com.powsybl:powsybl-iidm-criteria 6.7.2.\n\ud83d\udccf Published: 2025-06-20T16:50:35.974Z\n\ud83d\udccf Modified: 2025-06-20T17:37:30.252Z\n\ud83d\udd17 References:\n1. https://github.com/powsybl/powsybl-core/security/advisories/GHSA-8qjw-9xgm-c9ff\n2. https://github.com/powsybl/powsybl-core/commit/d8398f689a5ccd505bd62eee2bd6670a29133110\n3. https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2", "creation_timestamp": "2025-06-20T17:46:18.000000Z"}