Vulnerability in Coala Git-Url-Parse

CVE-2023-32758

giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.

Vulnerability class: ReDoS (Regular Expression Denial of Service)

EPSS: 0.010 (60.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2023-32758?
CVE-2023-32758 is a high-severity vulnerability in Coala Git-Url-Parse, classified under Inefficient Regular Expression Complexity. CVSS score: 7.5/10. Published 2023-05-15.
How severe is CVE-2023-32758?
High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2023-32758 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.