git-url-parse Regular Expression Denial of Service

published 2023-05-15 3 y ago modified 2026-07-07 4 mo ago also GHSA-4xqq-73wg-5mjp , PYSEC-2026-1404 , EUVD-2023-1471

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits: 0; none known

giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.

Patch / fix

links 3

github.com/returntocorp/semgrep#7611 pull request
github.com/returntocorp/semgrep#7955 pull request
github.com/returntocorp/semgrep#7943 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-32758 updated 2025-11-21 cvss 7.5

python-git-url-parse: ReDoS via untrusted URLs

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 21 mo ago (2025-01-23)

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	git-url-parse	<=1.2.2	no fix listed

Classification

Weakness

CWE-1333 Inefficient Regular Expression Complexity

References

github.com /returntocorp/semgrep/pull/7611
web, issue-tracking, patch
github.com /returntocorp/semgrep/pull/7955
web
github.com /returntocorp/semgrep/pull/7943
web
github.com /coala/git-url-parse/blob/master/giturlparse/parser.py#L53
web, product
pypi.org /project/git-url-parse
web, product
nvd.nist.gov /vuln/detail/CVE-2023-32758
advisory
github.com /coala/git-url-parse
package
github.com /advisories/GHSA-4xqq-73wg-5mjp
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary