VYPR
← All advisories
High severityNVD Advisory· Published Nov 17, 2023· Updated Aug 2, 2024

CVE-2023-46402

CVE-2023-46402

Description

git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

git-urls 1.0.0 contains a ReDoS vulnerability in its URL parsing regex, allowing denial of service via crafted long inputs.

Vulnerability

Analysis

The git-urls package version 1.0.0 contains a Regular Expression Denial of Service (ReDoS) vulnerability in its urls.go file. The vulnerable regular expression on line 35 is used to parse SCP-style git URLs. Due to the regex's complexity, providing a crafted long string as the directory path can cause catastrophic backtracking, leading to excessive CPU consumption [1][2].

Exploitation

An attacker can exploit this vulnerability without authentication by sending a specially crafted URL to any service that uses the git-urls library to parse user-supplied git URLs. The proof of concept demonstrates that a payload of repeated "/" characters (e.g., 19 million repetitions) can cause a delay of approximately 7 seconds on a typical system [2]. The attack vector is remote, requiring only that the target application processes the attacker-controlled input through ParseScp or similar functions.

Impact

The primary impact is a denial of service condition. By sending a single malicious URL, an attacker can cause the targeted application to hang or become unresponsive for a significant duration. If multiple such requests are made, the service may become completely unavailable. The vulnerability does not lead to code execution or data leakage [1].

Mitigation

As of the publication date, the maintainer has not released a fix for this vulnerability [2][3]. Users are advised to apply input validation to limit the length of URL components before parsing, or to switch to an alternative, maintained git URL parsing library. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

References
  1. NVD - CVE-2023-46402
  2. Security issue in regex inside git-urls package
  3. GitHub - whilp/git-urls: git-urls parses git URLs

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/whilp/git-urlsGo
<= 1.0.1—

Affected products

60

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.