CVE-2025-54364

Summary

Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. option_descriptions employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume of whitespace without a terminating colon. An attacker who can control or inject docstring content into affected applications can trigger excessive CPU consumption. This software is used by Azure CLI.

Affected Software

Weaknesses

• CWE-1333: CWE-1333 Inefficient Regular Expression Complexity

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/microsoft/knack
• https://www.vulncheck.com/advisories/microsoft-knack-python-package-regular-expression-dos

• ←Previous
• Next→