GHSA-RQPX-F6RC-7HM5 PowSyBl Core contains Polynomial REDoS’es

Impact What kind of vulnerability is it? Who is impacted? This is an advisory for a potential polynomial Regular Expression Denial of Service ReDoS vulnerability in the PowSyBl's DataSource mechanism. When the listNamesString regex method is called on a DataSource, the user-supplied regular...

GHSA-F5CX-H789-J959 PowSyBl Core allows deserialization of untrusted SparseMatrix data

Impact What kind of vulnerability is it? Who is impacted? This is a disclosure for a security vulnerability in the SparseMatrix class. The vulnerability is a deserialization issue that can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the re...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the read method of the SparseMatrix class. An attacker can execute arbitrary code or escalate privileges by providing a crafted serialized object to be deserialized. Note: This is only exploitable i...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the com.powsybl.commons.xml.XmlReader class. An attacker can access sensitive files or internal resources by submitting specially crafted XML input. Note: This is only exploitable if untrusted users...

GHSA-QPJ9-QCWX-8JV2 PowSyBl Core XML Reader allows XXE and SSRF

Impact What kind of vulnerability is it? Who is impacted? In certain places, powsybl-core XML parsing is vulnerable to an XXE attack and in on place also to an SSRF attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the com.powsybl.commons.xml.XmlReader class. An attacker can access sensitive files or internal resources by submitting specially crafted XML input. Note: This is only exploitable if untrusted users...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the com.powsybl.commons.xml.XmlReader class. An attacker can access sensitive files or internal resources by submitting specially crafted XML input. Note: This is only exploitable if untrusted users...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the com.powsybl.commons.xml.XmlReader class. An attacker can access sensitive files or internal resources by submitting specially crafted XML input. Note: This is only exploitable if untrusted users...

PowSyBl Core XML Reader allows XXE and SSRF

Impact What kind of vulnerability is it? Who is impacted? In certain places, powsybl-core XML parsing is vulnerable to an XXE attack and in on place also to an SSRF attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive...

PT-2025-26231 · Powsybl · Powsybl

Name of the Vulnerable Software and Affected Versions: PowSyBl versions prior to 6.7.2 Description: The issue concerns an XML external entity XXE attack and a server-side request forgery SSRF attack in certain places of powsybl-core XML parsing. This allows an attacker to elevate their privileges...

PowSyBl Core 代码问题漏洞

PowSyBl Core is a PowSyBl open source software building framework for power systems. A code issue vulnerability exists in PowSyBl Core versions 6.3.0 through 6.7.1, which stems from a deserialization issue in the read method of the SparseMatrix class that could lead to elevation of privilege...

PT-2025-26255 · Powsybl · Powsybl

Name of the Vulnerable Software and Affected Versions: PowSyBl versions prior to 6.7.2 Description: The issue is a potential polynomial Regular Expression Denial of Service ReDoS vulnerability in the PowSyBl's DataSource mechanism. This vulnerability can be exploited when the listNamesString rege...

PowSyBl Core 安全漏洞

PowSyBl Core is a PowSyBl open source software building framework for power systems. A security vulnerability exists in PowSyBl Core versions prior to 6.7.2 that stems from XML parsing vulnerability to XML external entity attacks and server-side request forgery attacks...

PT-2025-26251 · Powsybl · Powsybl

Name of the Vulnerable Software and Affected Versions: PowSyBl versions 6.3.0 through 6.7.1 Description: The issue is a deserialization problem in the read method of the SparseMatrix class, which can lead to various privilege escalations depending on the circumstances. This method takes an...