What’s Vulnerable › Vulnerabilities

CVE-2025-54363

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-20 · updated 2026-06-17
• Weakness: CWE-1333

Description

Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. extract_full_summary_from_signature employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume of whitespace without a terminating colon. An attacker who can control or inject docstring content into affected applications can trigger excessive CPU consumption. This software is used by Azure CLI.

Affected products

• Microsoft Knack: 0.12.0

References

• https://github.com/microsoft/knack
• https://github.com/microsoft/knack/issues/281
• https://www.vulncheck.com/advisories/microsoft-knack-python-package-regular-expression-dos

Get alerted when CVE-2025-54363 or the next vulnerability affects your stack