PT-2025-7073 · Github · @Octokit/Request
Shiyubanzhou
·
Published
2025-02-14
·
Updated
2026-06-04
·
CVE-2025-25290
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions:
@octokit/request versions 1.0.0 through 9.2.1
Description:
The regular expression
/<([^>]+)>; rel="deprecation"/ used to match the link header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious link header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability.Recommendations:
For versions 1.0.0 through 9.2.1, update to version 9.2.1 to fix the issue.
As a temporary workaround, consider disabling the use of the
link header in HTTP responses until a patch is available.
Restrict access to the vulnerable regular expression to minimize the risk of exploitation.
Avoid using the link header with specially crafted input in the affected API endpoint until the issue is resolved.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Octokit/Request