Read the docs
TI-2025-30430 Aliases CVE-2025-48059GHSA-8qjw-9xgm-c9ff

PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion

Priority LOW 20CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and com.powsybl:powsybl-contingency-api versions 5.0.0 to before 6.3.0, there is a a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the RegexCriterion class. This class compiles and evaluates an unvalidated, user-supplied regular expression against the identifier of an Identifiable object via Pattern.compile(regex).matcher(id).find(). If successfully exploited, a malicious actor can cause significant CPU exhaustion through repeated or recursive filter(...) calls — especially if performed over large network models or filtering operations. This issue has been patched in com.powsybl:powsybl-iidm-criteria 6.7.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00575 47th percentileScored 2026-11-07
Fix Fixed powsybl-core (powsybl): 6.7.2com.powsybl:powsybl-iidm-criteria (Maven): 6.7.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
powsyblpowsybl-core6.3.0 to before 6.7.2; 5.0.0 to before 6.3.06.7.2Patch availableCNA
—com.powsybl:powsybl-iidm-criteria (Maven)6.3.0 to before 6.7.26.7.2Patch availableGHSA-8qjw-9xgm-c9ff
—com.powsybl:powsybl-contingency-api (Maven)5.0.0 to before 6.3.06.3.0Patch availableGHSA-8qjw-9xgm-c9ff
  • powsybl-core Vendorpowsybl Affected 6.3.0 to before 6.7.2; 5.0.0 to before 6.3.0 Fixed in 6.7.2 Patch available CNA
  • com.powsybl:powsybl-iidm-criteria (Maven) Vendor— Affected 6.3.0 to before 6.7.2 Fixed in 6.7.2 Patch available GHSA-8qjw-9xgm-c9ff
  • com.powsybl:powsybl-contingency-api (Maven) Vendor— Affected 5.0.0 to before 6.3.0 Fixed in 6.3.0 Patch available GHSA-8qjw-9xgm-c9ff

Remediation

  • Fix · CNA powsybl-core (powsybl) Fixed in 6.7.2
  • Fix · GHSA-8qjw-9xgm-c9ff com.powsybl:powsybl-iidm-criteria (Maven) Fixed in 6.7.2 Advisory →
  • Fix · GHSA-8qjw-9xgm-c9ff com.powsybl:powsybl-contingency-api (Maven) Fixed in 6.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-48059
  2. 2026-10-03 Alias added: GHSA-8qjw-9xgm-c9ff

References

Advisory 1

Other 4

  • TI-2025-30237 PowSyBl Core allows deserialization of untrusted SparseMatrix data CVSS 4.0HIGH 8.1
  • TI-2025-30429 PowSyBl Core contains Polynomial REDoS’es CVSS 4.0MEDIUM 6.3
  • TI-2026-40195 PowSyBl: Command Injection in LocalCommandExecutor-s CVSS 4.0HIGH 7.1
  • TI-2025-29823 PowSyBl Core XML Reader allows XXE and SSRF CVSS 4.0LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences