CVE-2025-9308

What it actually does

The flaw triggers catastrophic backtracking in a regular expression within the setOptions function of src/util/request-manager.js, allowing a local attacker to induce excessive CPU consumption and denial of service.

Why it matters to the business

Organizations relying on affected Chainguard OpenJDK packages may experience disrupted local build or package management operations, leading to delays in development workflows and potential resource exhaustion on developer or CI systems; the packages are no longer maintained upstream, increasing long-term operational risk.

How an attack unfolds

An attacker with local access supplies specially crafted input to the setOptions function that causes the vulnerable regular expression to enter a high-complexity matching state, consuming CPU resources until the process is terminated or becomes unresponsive.

How to fix it

Upgrade the affected Chainguard packages to the fixed versions listed (openjdk-17-openj9 and related packages at 0.53.0-r0 or newer). Because the upstream Yarn maintainer no longer supports versions up to 1.22.22, replace any remaining instances of the vulnerable Yarn code with a supported alternative.

How to confirm the fix worked

Confirm that the installed Chainguard package versions match or exceed the fixed releases (0.53.0-r0). Inspect the request-manager.js file to verify the regex pattern in setOptions has been updated or removed. Re-run any local package or build operations that previously exercised the vulnerable code path.

Typical attack path

1. Obtain local access to a system using an affected Chainguard OpenJDK package containing Yarn <= 1.22.22
2. Identify or trigger invocation of the setOptions function in src/util/request-manager.js
3. Supply input containing a crafted string that forces inefficient regex evaluation
4. Observe sustained high CPU usage leading to denial of service

How to detect it

Review process execution logs and resource utilization metrics on systems running the affected packages for unexplained CPU spikes during Yarn-related operations. Examine package manifests and installed file versions to identify presence of Yarn 1.22.22 or earlier.

What your security team should do

• Immediately upgrade all listed Chainguard OpenJDK packages to version 0.53.0-r0 or later
• Audit developer and CI environments for any direct or transitive use of Yarn <= 1.22.22
• Remove or replace unsupported Yarn installations with actively maintained package managers
• Monitor for high CPU events during package operations as a temporary detection measure