GitHub Advisoryadvisory · Maven

GHSA-cw56-j3fm-7w57 Regular expression denial of service in Apache ShenYu

HIGH Published 2022-05-18 Modified 2023-07-11 Official page ↗
Aliases
CVE-2022-26650
Ecosystem
Maven
Packages
org.apache.shenyu:shenyu, org.apache.shenyu:shenyu-bootstrap
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-862
Reviewed
2022-05-25

Affected packages

• Maven org.apache.shenyu:shenyu: >= 2.4.0, < 2.4.3 → fixed in 2.4.3 • Maven org.apache.shenyu:shenyu-bootstrap: >= 2.4.0, < 2.4.3 → fixed in 2.4.3

Description

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.

Related

Alias · CVE (1)

  • CVE-2022-26650 In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make… vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-862 Missing Authorization weakness

References