CVE-2025-48058: 
Java vulnerability analysis and mitigation

PowSyBl (Power System Blocks), a framework for building power system oriented software, was found to contain a polynomial Regular Expression Denial of Service (ReDoS) vulnerability in its DataSource mechanism prior to version 6.7.2. The vulnerability was assigned CVE-2025-48058 and was discovered in June 2025. The issue affects the listNames(String regex) method in the DataSource component, which handles file-like resource names (GitHub Advisory).

The vulnerability exists in the listNames(String regex) method of the DataSource mechanism, where user-supplied regular expressions are compiled and evaluated against file-like resource names without proper validation. The issue is classified as CWE-1333 (Inefficient Regular Expression Complexity) and received a CVSS v4.0 score of 6.3 MEDIUM. The vulnerability requires two attacker-controlled conditions: control over the regex input passed into listNames(String regex) and influence over the file/resource names being matched. For example, an attacker could supply a malicious pattern like (.*a){10000} combined with specifically crafted filenames to trigger extensive regex engine backtracking (GitHub Advisory).

When successfully exploited, this vulnerability can cause significant CPU consumption due to regex backtracking, even with polynomial patterns. In a multi-tenant environment, an attacker can degrade the server's performance to an extent that affects other users of the application. This can be particularly impactful in scenarios where time advantage provides a competitive edge. The vulnerability affects systems that make direct calls to the listNames(String regex) method on a class implementing the ReadOnlyDataSource interface, especially when the regex parameter is not controlled and the datasource points to an archive or directory where untrusted users can edit filenames (GitHub Advisory).

The vulnerability has been patched in PowSyBl version 6.7.2. Users are advised to upgrade to this version or later to address the security issue. The fix was released as part of a security update that also addressed several other vulnerabilities (GitHub Release).