Bug 2345822 (CVE-2025-25288)

Summary: CVE-2025-25288 octokit/plugin-paginate-rest: @octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, alcohan, alizardo, anujha, asoldano, bbaranow, bmaxwell, brian.stansberry, bstansbe, caswilli, cmiranda, darran.lofthouse, dhanak, dkreling, dlofthou, dosoudil, drosa, dsimansk, gkamathe, gparvin, istudens, ivassile, iweiss, janstey, jchui, jhe, kaycoth, kingland, ktsao, kverlaen, matzew, mnovotny, mosmerov, msochure, msvehla, nboldt, njean, nwallace, oaljalju, owatkins, pahickey, pberan, pcongius, pesilva, pierdipi, pjindal, pmackay, psrna, rguimara, rhaigner, rhuss, rstancel, sausingh, sdawley, smaestri, thjenkin, tom.jenkinson, vdosoudi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the plugin-paginate-rest Octokit plugin. When calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance with a malicious `link` parameter in the `headers` section of the `request` can trigger a regular expression denial-of-service (ReDoS) attack.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-02-14 20:01:14 UTC
@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.