« Volver al listado

CVE-2025-25289

Estado: AplazadaMedia (5.3)—

@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and "@", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Octokit — Request-errorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-25289",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-25289",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-14T20:08:24.260356Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "octokit",
          "product": "request-error.js",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.0.0, < 6.1.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-02-14T20:15:35.100",
  "references": [
    {
      "url": "https://github.com/octokit/request-error.js/blob/main/src/index.ts",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/octokit/request-error.js/commit/d558320874a4bc8d356babf1079e6f0056a59b9e",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/octokit/request-error.js/security/advisories/GHSA-xx4v-prfh-6cgc",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and \"@\", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue."
    },
    {
      "lang": "es",
      "value": "@octokit/request-error es una clase de error para los errores de solicitud de Octokit. A partir de la versión 1.0.0 y antes de la versión 6.1.7, existe una vulnerabilidad de denegación de servicio de expresión regular (ReDoS) en el procesamiento de encabezados de solicitud HTTP. Al enviar un encabezado de autorización que contiene una secuencia excesivamente larga de espacios seguidos de una nueva línea y \"@\", un atacante puede explotar un procesamiento ineficiente de expresiones regulares, lo que lleva a un consumo excesivo de recursos. Esto puede degradar significativamente el rendimiento del servidor o causar una condición de denegación de servicio (DoS), lo que afecta la disponibilidad. La versión 6.1.7 contiene una solución para el problema."
    }
  ],
  "lastModified": "2026-06-17T09:00:37.410",
  "sourceIdentifier": "security-advisories@github.com"
}