Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity
Overview
A security review of the Cattown identified multiple weaknesses that could potentially impact its stability and security.
Affected Versions
- All versions below 1.0.2
Description of Vulnerabilities
- CWE-1333: Inefficient Regular Expression Complexity The package used regular expressions with inefficient, potentially exponential worst-case complexity. This can cause excessive CPU usage due to excessive backtracking on crafted inputs, potentially leading to denial of service.
- CWE-400: Uncontrolled Resource Consumption (Resource Exhaustion) The package was vulnerable to resource exhaustion, where processing malicious inputs could cause high CPU or memory usage, potentially leading to denial of service.
Impact
- Trigger excessive CPU consumption leading to denial of service
- Cause resource exhaustion affecting service availability
- Bypass protection mechanisms causing unexpected or insecure behavior
Resolution
These vulnerabilities have been fixed in version 1.0.2 of the Cattown. Users are strongly encouraged to upgrade to this version to mitigate the risks.
Recommendations
- Upgrade to Cattown version 1.0.2 or later as soon as possible.
- Review and restrict input sources if untrusted inputs are processed.
Acknowledgments
The issues were proactively identified through CodeQL static analysis.
Betroffene Software
Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.
| Plattform | Paket | Anfällige Versionen | Behoben in |
|---|---|---|---|
| npm-Paket | cattown | < 1.0.2 | 1.0.2 |
Verweise
- https://github.com/IEatUranium238/Cattown/security/advisories/GHSA-455v-w7r9-3vv9
- https://nvd.nist.gov/vuln/detail/CVE-2025-58451
- https://github.com/IEatUranium238/Cattown/commit/70c2a28fb7dc520cfb7e401e0e141bff3dd26ead
- https://github.com/IEatUranium238/Cattown
- https://github.com/IEatUranium238/Cattown/releases/tag/security
- https://www.npmjs.com/package/cattown
- CVSS-Vektor
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Schwäche (CWE)
CWE-1333, CWE-400- Plattform
- npm
- Paket
cattown- Veröffentlicht
- 09.09.2025
- Aktualisiert
- 11.10.2026 10:22
Quellen und Lizenzen
OSV / GitHub Advisory Database - GHSA-455v-w7r9-3vv9 - CC BY 4.0
Schwachstellenhistorie: cattown
Alle veröffentlichten Schwachstellen dieses Pakets (npm-Paket), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.
Dies ist die einzige bekannte Schwachstelle dieses Pakets.
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.