CVE-2022-42964

What it actually does

Triggers catastrophic backtracking in a regular expression inside GaussianInput.from_string, causing the Python process to consume CPU indefinitely and resulting in denial of service.

Why it matters to the business

Applications or services that parse untrusted Gaussian input files become unresponsive or exhaust resources, interrupting scientific workflows and potentially requiring manual restarts.

How an attack unfolds

An attacker supplies a specially crafted string containing repeated patterns that trigger exponential regex backtracking to the from_string method; because the call is reachable over the network or via file upload in many pymatgen consumers, the single request or file causes sustained high CPU usage without authentication.

How to fix it

Upgrade pymatgen to a version containing a patched regex; until a fixed release is available, wrap calls to from_string with input-length limits or timeouts and avoid processing untrusted Gaussian files.

How to confirm the fix worked

Test the from_string method with known ReDoS payloads while monitoring CPU time; confirm that processing completes within expected bounds after upgrade or mitigation.

Typical attack path

1. Locate an application or service that accepts user-supplied data and passes it to pymatgen GaussianInput.from_string
2. Craft an input string engineered to produce catastrophic backtracking in the vulnerable regex
3. Submit the malicious string via network request, file upload, or API call
4. Observe sustained high CPU consumption and eventual service degradation or crash

How to detect it

Review application logs and system metrics for sudden spikes in CPU usage correlated with calls involving Gaussian input parsing; examine web-server or application logs for unusually long request durations or repeated submissions to endpoints that invoke from_string.

What your security team should do

• Inventory all deployments that import pymatgen and identify code paths calling GaussianInput.from_string
• Apply input sanitization or timeouts immediately where upgrades are not yet possible
• Monitor for availability of a patched pymatgen release and schedule upgrade
• Add resource-usage alerts for Python processes handling Gaussian input