Vulnerability · Published Aug 20, 2025 · Assigned by mitre
CVE-2025-54364
Medium 6.9
In plain English
A medium-severity regular-expression denial of service in Knack from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. option_descriptions employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume of whitespace without a terminating colon. An attacker who can control or inject docstring content into affected applications can trigger excessive CPU consumption. This software is used by Azure CLI.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | knack | no fix listed | DEBIAN-CVE-2025-54364 |
| Debian:13 | knack | no fix listed | DEBIAN-CVE-2025-54364 |
| Debian:14 | knack | no fix listed | DEBIAN-CVE-2025-54364 |
| PyPI | knack | no fix listed | GHSA-xh9h-692f-mmg4 |
| Ubuntu:22.04:LTS | knack | no fix listed | UBUNTU-CVE-2025-54364 |
| Ubuntu:24.04:LTS | knack | no fix listed | UBUNTU-CVE-2025-54364 |
| Ubuntu:25.10 | knack | no fix listed | UBUNTU-CVE-2025-54364 |
| Ubuntu:26.04:LTS | knack | no fix listed | UBUNTU-CVE-2025-54364 |
| Ubuntu:26.10 | knack | no fix listed | UBUNTU-CVE-2025-54364 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N