Vulnerability · Published May 15, 2023 · Assigned by mitre
CVE-2023-32758
High 7.5
In plain English
A high-severity regular-expression denial of service in the git-url-parse package (PyPI). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Official description
giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | git-url-parse | no fix listed | GHSA-4xqq-73wg-5mjp |
| PyPI | git-url-parse | no fix listed | PYSEC-2026-1404 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H