Vulnerability Description
Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. option_descriptions employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume of whitespace without a terminating colon. An attacker who can control or inject docstring content into affected applications can trigger excessive CPU consumption. This software is used by Azure CLI.
Related Weaknesses (CWE)
References
- https://github.com/microsoft/knack
- https://www.vulncheck.com/advisories/microsoft-knack-python-package-regular-expr
FAQ
What is CVE-2025-54364?
CVE-2025-54364 is a documented vulnerability. Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. option_descriptions employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)...
How severe is CVE-2025-54364?
CVSS scoring is not yet available for CVE-2025-54364. Check NVD for updates.
Is there a patch for CVE-2025-54364?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.