Advisories

Microsoft Knack (knack.introspection module) Python Package ReDoS

Go Back
severity
medium
date
Affecting
  • knack.introspection module <= 0.12.0

CVE type
Regular Expression Denial of Service (ReDoS)
CVSS
6.9
CVSS V4 Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Credit
Sajeeb Lohani of Bugcrowd Security Innovation Lab
Description
Regular Expression Denial of Service (ReDoS) vulnerabilities exist in the knack.introspection module, part of the knack Python package maintained by Microsoft and used by Azure CLI. The functions, extract_full_summary_from_signature (CVE-2025-54363) and option_descriptions (CVE-2025-54364), employ an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)". This pattern is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume of whitespace without a terminating colon. An attacker who can control or inject docstring content into affected applications can trigger excessive CPU consumption and degrade performance over time. Processing time increases exponentially with input size, potentially leading to resource exhaustion and denial of service.