~ / search / GHSA-5662-2rj7-f2v6

GHSA-5662-2rj7-f2v6

copyparty allows Regex Denial of Service (ReDoS) in the upload listing

Source: GitHub Advisory Database (reviewed) High CVE-2025-54796

Packages

EcosystemPackageAffectedFixed in
PyPI copyparty < 1.18.9 1.18.9

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary The `filter` parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server. ### PoC `https://127.0.0.1:3923/?ru&filter=(.+)+x` ### Impact The server becomes fully inaccessible for a long time.

References

External links from the advisory. They lead to third-party sites.