Summary
PowSyBl Core contains Polynomial REDoS’es
Am I impacted?
You are vulnerable if you make direct calls to the listNames(String regex) method on a class implementing the ReadOnlyDataSource interface, don't control the regular expression used as regex parameter, and if this datasource points to an archive or directory where an untrusted user may edit the filenames.
For instance, this could be the case if you want to list the files made available by a datasource which names respect a user-provided regular expression.
Note that only direct calls to this method are concerned. There are several usages of this method in powsybl, but the provided regular expressions are all hardcoded and therefore cannot be provided by a malicious user.
References
Impact
What kind of vulnerability is it? Who is impacted?
This is an advisory for a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl's DataSource mechanism. When the listNames(String regex) method is called on a DataSource, the user-supplied regular expression (which may be unvalidated) is compiled and evaluated against a collection of file-like resource names.
To trigger a polynomial ReDoS via this mechanism, two attacker-controlled conditions must be met:
- Control over the regex input passed into
listNames(String regex).- Example: An attacker supplies a malicious pattern like
(.*a){10000}.
- Example: An attacker supplies a malicious pattern like
- Control or influence over the file/resource names being matched.
- Example: Filenames such as
"aaaa...!"that induce regex engine backtracking.
- Example: Filenames such as
If both conditions are satisfied, a malicious actor can cause significant CPU consumption due to regex backtracking, even
with polynomial patterns. Since both inputs can be controlled via a publicly accessible method or external filesystem handling,
the listNames(String regex) method is considered vulnerable to polynomial REDoS.
Unlike classic catastrophic exponential ReDoS, this subtle attack exploits a greedy .* prefix followed by a fixed suffix, repeated multiple times.
When applied to long filenames that almost match the pattern, the regex engine performs extensive backtracking, degrading performance predictably with input size. In a multi-tenant environment, an attacker can degrade the performance - and thereby the availability - of the server to an extent that it affects other users of the application. This can for example be useful if an attacker wants to delay other users in a scenario where a time advantage can be a competitive advantage.
A tricky part in this is that the attacker needs to control both the pattern and the input which may not always be the case.
A regular expression with worst-case exponential or polynomial matching time is applied to untrusted input, causing excessive CPU use. Typical impact: denial of service when input is crafted to trigger backtracking.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
com.powsybl:powsybl-commons:6.7.2 and higher
Frequently Asked Questions
- What is CVE-2025-48058? CVE-2025-48058 is a medium-severity inefficient regular expression (ReDoS) vulnerability in com.powsybl:powsybl-commons (maven), affecting versions <= 6.7.1. It is fixed in 6.7.2. A regular expression with worst-case exponential or polynomial matching time is applied to untrusted input, causing excessive CPU use.
- Which versions of com.powsybl:powsybl-commons are affected by CVE-2025-48058? com.powsybl:powsybl-commons (maven) versions <= 6.7.1 is affected.
- Is there a fix for CVE-2025-48058? Yes. CVE-2025-48058 is fixed in 6.7.2. Upgrade to this version or later.
- Is CVE-2025-48058 exploitable, and should I be worried? Whether CVE-2025-48058 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2025-48058 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2025-48058? Upgrade
com.powsybl:powsybl-commonsto 6.7.2 or later.