CVE-2025-48058: PowSyBl ReDoS DoS Vulnerability

CVE-2025-48058 Overview

CVE-2025-48058 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting PowSyBl (Power System Blocks), a Java framework used to build power system oriented software. The flaw resides in the DataSource mechanism, where polynomial regular expression patterns are susceptible to catastrophic backtracking. An attacker capable of supplying crafted input to a component that uses the vulnerable regex can force excessive CPU consumption. The issue affects versions prior to 6.7.2 of the com.powsybl:powsybl-commons package and is tracked under CWE-1333: Inefficient Regular Expression Complexity.

Critical Impact
A remote actor can trigger sustained CPU exhaustion in PowSyBl-based services, degrading availability of power-system modeling and analysis workloads.

Affected Products

PowSyBl powsybl-core versions prior to 6.7.2
Maven artifact com.powsybl:powsybl-commons prior to 6.7.2
Downstream applications and modules embedding PowSyBl's DataSource mechanism (including ampl-converter and cgmes-conversion)

Discovery Timeline

2025-06-20 - CVE-2025-48058 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48058

Vulnerability Analysis

The vulnerability is a polynomial-time ReDoS in PowSyBl's DataSource component. PowSyBl uses java.util.regex patterns to match filenames and data-entry identifiers. Certain patterns exhibit polynomial complexity when the regex engine backtracks over crafted input. When an attacker submits input containing repeated characters that partially match ambiguous quantified groups, matching time grows non-linearly with input size.

Because java.util.regex uses a backtracking NFA engine, even patterns that appear linear can degrade to O(n^2) or worse. The maintainers addressed this by migrating vulnerable call sites to Google's com.google.re2j library, which provides linear-time matching guarantees using an RE2-style automaton and does not backtrack.

Root Cause

The root cause is the use of Java's default backtracking regex engine against attacker-influenced input inside DataSource handling logic. Patterns that permit overlapping matches across quantified groups allow the engine to explore an exponential or polynomial number of match paths on non-matching inputs. This falls under CWE-1333 (Inefficient Regular Expression Complexity).

Attack Vector

The attack vector is network-adjacent: any interface that accepts a filename, entry name, or data identifier processed by DataSource can be abused. An attacker submits a payload designed to trigger regex backtracking. The regex engine consumes CPU while attempting to match, blocking a worker thread and reducing throughput. Repeated requests can exhaust CPU capacity on the host.

java

// Patch excerpt: ampl-converter/src/main/java/com/powsybl/ampl/converter/AmplNetworkReader.java
 package com.powsybl.ampl.converter;
 
 import com.powsybl.commons.datasource.ReadOnlyDataSource;
+import com.google.re2j.Matcher;
+import com.google.re2j.Pattern;
 import com.powsybl.commons.util.StringToIntMapper;
 import com.powsybl.iidm.network.*;
 import org.slf4j.Logger;

// Patch excerpt: cgmes/cgmes-conversion/src/main/java/com/powsybl/cgmes/conversion/export/CgmesExportUtil.java
  */
 package com.powsybl.cgmes.conversion.export;
 
+import com.google.re2j.Pattern;
 import com.powsybl.cgmes.conversion.CgmesReports;
 import com.powsybl.cgmes.conversion.Conversion;
 import com.powsybl.cgmes.conversion.export.elements.RegulatingControlEq;

Source: powsybl-core commit 72f79de. The patch replaces java.util.regex.Pattern and Matcher with com.google.re2j equivalents, eliminating catastrophic backtracking on the affected code paths.

Detection Methods for CVE-2025-48058

Indicators of Compromise

Sustained high CPU utilization on Java Virtual Machine (JVM) threads running PowSyBl workloads without a corresponding increase in successful request volume.
Thread dumps showing threads blocked inside java.util.regex.Pattern$* or Matcher.match for extended periods.
Requests submitting unusually long or repetitive filenames or data-entry identifiers to PowSyBl-fronted endpoints.

Detection Strategies

Inventory Java dependencies for com.powsybl:powsybl-commons and related PowSyBl artifacts at versions below 6.7.2 using Software Composition Analysis (SCA) tooling.
Instrument application performance monitoring (APM) to alert when regex evaluation time exceeds a defined threshold per request.
Correlate JVM CPU spikes with inbound HTTP or messaging payloads that contain long strings of repeating characters.

Monitoring Recommendations

Log and sample input strings passed to DataSource methods for offline analysis against known ReDoS payload signatures.
Track per-endpoint p95 and p99 latency for services embedding PowSyBl; ReDoS attacks manifest as tail-latency degradation before full CPU saturation.
Enable JVM Flight Recorder or continuous profiling to capture stack traces during CPU spikes for post-incident triage.

How to Mitigate CVE-2025-48058

Immediate Actions Required

Upgrade com.powsybl:powsybl-commons and all PowSyBl components to version 6.7.2 or later.
Audit application code for other uses of java.util.regex.Pattern against untrusted input and evaluate migration to com.google.re2j.
Apply request-size limits and input validation on any field forwarded into PowSyBl's DataSource layer.

Patch Information

The fix is included in PowSyBl 6.7.2. See the GitHub Security Advisory GHSA-rqpx-f6rc-7hm5, the v6.7.2 release notes, and the remediation commit 72f79de. The patch replaces backtracking regex engines with com.google.re2j in affected classes including AmplNetworkReader and CgmesExportUtil.

Workarounds

Restrict input length for fields consumed by PowSyBl to a conservative maximum (for example, 256 characters) at the application boundary.
Enforce a request timeout on operations that invoke DataSource so that a single request cannot monopolize a worker thread.
Deploy a web application firewall (WAF) rule to reject payloads containing extreme repetition patterns targeting the affected fields.

bash

# Maven: upgrade PowSyBl to a patched release
mvn versions:use-dep-version \
  -Dincludes=com.powsybl:powsybl-commons \
  -DdepVersion=6.7.2 \
  -DforceVersion=true

# Gradle: pin the patched version in build.gradle
# implementation 'com.powsybl:powsybl-commons:6.7.2'