{"id":"CVE-2025-58451","aliases":["GHSA-455v-w7r9-3vv9"],"url":"https://o3.security/vulnerability/CVE-2025-58451","summary":"Cattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource Consumption","details":"### Overview\nA security review of the Cattown identified multiple weaknesses that could potentially impact its stability and security.\n\n### Affected Versions\n- All versions below 1.0.2\n\n### Description of Vulnerabilities\n1. CWE-1333: Inefficient Regular Expression Complexity\nThe package used regular expressions with inefficient, potentially exponential worst-case complexity. This can cause excessive CPU usage due to excessive backtracking on crafted inputs, potentially leading to denial of service.\n2. CWE-400: Uncontrolled Resource Consumption (Resource Exhaustion)\nThe package was vulnerable to resource exhaustion, where processing malicious inputs could cause high CPU or memory usage, potentially leading to denial of service.\n\n### Impact\n- Trigger excessive CPU consumption leading to denial of service\n- Cause resource exhaustion affecting service availability\n- Bypass protection mechanisms causing unexpected or insecure behavior\n\n### Resolution\nThese vulnerabilities have been fixed in version 1.0.2 of the Cattown. Users are strongly encouraged to upgrade to this version to mitigate the risks.\n\n### Recommendations\n- Upgrade to Cattown version 1.0.2 or later as soon as possible.\n- Review and restrict input sources if untrusted inputs are processed.\n\n### Acknowledgments\nThe issues were proactively identified through CodeQL static analysis.","published":"2025-09-08T22:07:48.516Z","modified":"2026-04-10T05:32:11.883003Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"cattown","fixedVersion":"1.0.2"}],"fix":{"url":"https://github.com/IEatUranium238/Cattown/commit/70c2a28fb7dc520cfb7e401e0e141bff3dd26ead","label":"IEatUranium238/Cattown@70c2a28"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58451.json"},{"type":"FIX","url":"https://github.com/IEatUranium238/Cattown/commit/70c2a28fb7dc520cfb7e401e0e141bff3dd26ead"},{"type":"ADVISORY","url":"https://github.com/IEatUranium238/Cattown/security/advisories/GHSA-455v-w7r9-3vv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58451"},{"type":"PACKAGE","url":"https://github.com/IEatUranium238/Cattown"},{"type":"WEB","url":"https://github.com/IEatUranium238/Cattown/releases/tag/security"},{"type":"WEB","url":"https://www.npmjs.com/package/cattown"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-04-10T05:32:11.883003Z"}}