CVE-2025-54363

CVE-2025-54363 is a unknown severity vulnerability affecting the affected product.

Description: Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. extract_full_summary_from_signature employs an inefficient regular expression pattern: “s(:param)s+(.+?)s:(.*)” that is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume of whitespace without a terminating colon. An attacker who can control or inject docstring content into affected applications can […]

Exploit Difficulty: HARD
⏱️ Time to exploit: > 4 hours
🛠️ Required skills: Advanced security expertise
💰 Public exploits: Rare or not public

How to Fix:


- Check if you're running the affected product


- Update to the latest patched version
- If patching is not immediately possible: restrict network exposure, apply least-privilege access


- Test the fix in a staging environment first
- Review logs for signs of exploitation
- Monitor for IOCs (Indicators of Compromise)


- Enable automatic security updates
- Set up vulnerability monitoring
- Review and harden security configurations