{"cve":"CVE-2023-32758","nvd":{"published":"2023-05-15T04:15:10.330","modified":"2026-06-17T05:59:32.180","status":"Modified","description":"giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-1333"],"references":["https://github.com/coala/git-url-parse/blob/master/giturlparse/parser.py#L53","https://github.com/returntocorp/semgrep/pull/7611","https://github.com/returntocorp/semgrep/pull/7943","https://github.com/returntocorp/semgrep/pull/7955","https://pypi.org/project/git-url-parse"],"products":["coala:git-url-parse"],"source":"nvd","synced_at":"2026-10-19T21:38:18.424950729+00:00"},"epss":{"cve":"CVE-2023-32758","score":0.01033,"percentile":0.63782,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-4xqq-73wg-5mjp","url":"https://osv.dev/vulnerability/GHSA-4xqq-73wg-5mjp","summary":"git-url-parse Regular Expression Denial of Service","modified":"2026-07-07T17:57:30.140691707Z","packages":[{"ecosystem":"PyPI","name":"git-url-parse","purl":"pkg:pypi/git-url-parse","ranges":["<=1.2.2"],"fixed":[]}]},{"id":"PYSEC-2026-1404","url":"https://osv.dev/vulnerability/PYSEC-2026-1404","summary":"git-url-parse Regular Expression Denial of Service","modified":"2026-07-07T17:46:43.225355631Z","packages":[{"ecosystem":"PyPI","name":"git-url-parse","purl":"pkg:pypi/git-url-parse","ranges":["<=1.2.2"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}