CVE-2025-54364: Microsoft Knack

Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days.

Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. option_descriptions employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume of whitespace without a terminating colon. An attacker who can control or inject docstring content into affected applications can trigger excessive CPU consumption. This software is used by Azure CLI.

Affected products

• Microsoft Knack: version 0.12.0 only

Published 2025-08-20. Last modified 2026-06-17.