High severity7.5NVD Advisory· Published May 15, 2023· Updated Jun 17, 2026
CVE-2023-32758
CVE-2023-32758
Description
giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
git-url-parsePyPI | <= 1.2.2 | — |
Affected products
3- giturlparse/git-url-parsedescription
Patches
Vulnerability mechanics
References
7- github.com/returntocorp/semgrep/pull/7611nvdIssue TrackingPatchWEB
- github.com/advisories/GHSA-4xqq-73wg-5mjpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-32758ghsaADVISORY
- github.com/coala/git-url-parse/blob/master/giturlparse/parser.pynvdProductWEB
- github.com/returntocorp/semgrep/pull/7943nvdWEB
- github.com/returntocorp/semgrep/pull/7955nvdWEB
- pypi.org/project/git-url-parsenvdProductWEB
News mentions
0No linked articles in our index yet.