Regular Expression Denial of Service in git-urls by 6en6ar

CVE-2023-46402

Summary

The git-urls package, version 1.0.0, is susceptible to a Regular Expression Denial of Service (ReDOS) attack. This vulnerability arises from poorly constructed regular expressions in urls.go, which can cause excessive backtracking and lead to performance degradation. Attackers can exploit this vulnerability to cause denial-of-service conditions, impairing the functionality of applications that depend on this library. It is crucial for developers using git-urls to update their libraries and adopt best practices in regex implementation to mitigate this risk.

References