Lucene search

K
osvGoogleOSV:GHSA-CW56-J3FM-7W57
HistoryMay 18, 2022 - 12:00 a.m.

Regular expression denial of service in Apache ShenYu

2022-05-1800:00:47
Google
osv.dev
13
apache shenyu
regular expression
denial of service
pattern matching
code injection
resource exhaustion
security vulnerability

EPSS

0.001

Percentile

47.4%

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.

EPSS

0.001

Percentile

47.4%

Related for OSV:GHSA-CW56-J3FM-7W57