CVE-2025-25285 @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

🗓️ 14 Feb 2025 19:31:44Reported by GoogleType

osv

osv🔗 osv.dev👁 6 Views

CVE-2025-25285 allows ReDoS attack in @octokit/endpoint versions 4.1.0 to 10.1.2, fixed in 10.1.3.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	3 Apr 202514:10	–	ibm
Chainguard	CVE-2025-25285 vulnerabilities	14 Feb 202520:15	–	cgr
Circl	CVE-2025-25285	14 Feb 202519:34	–	circl
CNNVD	Octokit 安全漏洞	14 Feb 202500:00	–	cnnvd
CVE	CVE-2025-25285	14 Feb 202519:31	–	cve
Cvelist	CVE-2025-25285 @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking	14 Feb 202519:31	–	cvelist
EUVD	EUVD-2025-4099	3 Oct 202520:07	–	euvd
Github Security Blog	@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking	14 Feb 202517:56	–	github
NVD	CVE-2025-25285	14 Feb 202520:15	–	nvd
OSV	CGA-7CR5-25MQ-FVPC	18 Feb 202517:27	–	osv

Source	Link
github	www.github.com/octokit/endpoint.js/blob/main/src/parse.ts
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25285.json
github	www.github.com/octokit/endpoint.js/security/advisories/GHSA-x4c5-c7rf-jjgv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-25285
github	www.github.com/octokit/endpoint.js/commit/6c9c5be033c450d436efb37de41b6470c22f7db8

10 Apr 2026 05:24Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.3

EPSS0.00081

cve-2025-25285 redos attack @octokit/endpoint version 4.1.0 version 10.1.3 cpu utilization