ReDoS vulnerability in Giskard text perturbation detector
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in Giskard's text perturbation detector, affecting versions prior to 2.15.5. The vulnerability in a URL-detection regex could cause excessive computation times or system crashes when processing specific text patterns.
What happened
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in Giskard's text perturbation detector by the GitHub Security Lab team. The vulnerability exists in a regex used to detect URLs and links in Giskard's punctuation removal transformation, which is susceptible to catastrophic backtracking when processing specific text patterns.
Reported impact
The vulnerability could trigger exponential regex evaluation times, potentially causing extended computation times or crashes in Giskard when processing text containing certain patterns.
Index analysis
Giskard versions prior to 2.15.5 are affected. The vulnerability was assigned CVE-2024-52524 and classified as Low severity. A fix was released in version 2.15.5.
Governance controls
The vulnerability was discovered by GHSL team member Kevin Backhouse and reported through GitHub's security advisory process.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.