Merge pull request #19738 from owen-mc/pr/felickz/19530

Set CWE-134 from 9.3 to 7.3 CVSS score for memory safe languages (#2)

Author: owen-mc

csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql

@@ -4,7 +4,7 @@
  *              and cause a denial of service.
  * @kind path-problem
  * @problem.severity error
- * @security-severity 9.3
+ * @security-severity 7.3
  * @precision high
  * @id cs/uncontrolled-format-string
  * @tags security

csharp/ql/src/change-notes/2025-06-06-reduce-CWE-134-for-memory-safe-languages.md

@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Adjusts the `@security-severity` from 9.3 to 7.3 for `cs/uncontrolled-format-string` to align `CWE-134` severity for memory safe languages to better reflect their impact.

java/ql/src/Security/CWE/CWE-134/ExternallyControlledFormatString.ql

@@ -3,7 +3,7 @@
  * @description Using external input in format strings can lead to exceptions or information leaks.
  * @kind path-problem
  * @problem.severity error
- * @security-severity 9.3
+ * @security-severity 7.3
  * @precision high
  * @id java/tainted-format-string
  * @tags security

java/ql/src/change-notes/2025-06-06-reduce-CWE-134-for-memory-safe-languages.md

@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Adjusts the `@security-severity` from 9.3 to 7.3 for `java/tainted-format-string` to align `CWE-134` severity for memory safe languages to better reflect their impact.

swift/ql/src/change-notes/2025-06-06-reduce-CWE-134-for-memory-safe-languages.md

@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* Adjusts the `@security-severity` from 9.3 to 7.3 for `swift/uncontrolled-format-string` to align `CWE-134` severity for memory safe languages to better reflect their impact.

swift/ql/src/queries/Security/CWE-134/UncontrolledFormatString.ql

@@ -3,7 +3,7 @@
  * @description Using external input in format strings can lead to exceptions or information leaks.
  * @kind path-problem
  * @problem.severity error
- * @security-severity 9.3
+ * @security-severity 7.3
  * @precision high
  * @id swift/uncontrolled-format-string
  * @tags security