GitHub Advisoryadvisory · PyPI

GHSA-5662-2rj7-f2v6 copyparty allows Regex Denial of Service (ReDoS) in the upload listing

HIGH Published 2025-08-04 Modified 2025-08-04 Official page ↗
Aliases
CVE-2025-54796
Ecosystem
PyPI
Packages
copyparty
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2025-08-04

Affected packages

• PyPI copyparty: < 1.18.9 → fixed in 1.18.9

Description

Summary The `filter` parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. PoC `https://127.0.0.1:3923/?ru&filter=(.+)+x` Impact The server becomes fully inaccessible for a long time.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References