GitHub Advisoryadvisory · Maven

GHSA-hf44-3mx6-vhhw Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

MEDIUM Published 2021-05-19 Modified 2021-05-19 Official page ↗
Aliases
CVE-2021-29506
Ecosystem
Maven
Packages
com.graphhopper:graphhopper-nav
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-05-19

Affected packages

• Maven com.graphhopper:graphhopper-nav: < 2.4 → fixed in 2.4

Description

Impact The regex injection that may lead to Denial of Service. Patches Will be patched in 2.4 and 3.0 Workarounds Versions lower than 2.x are only affected if the navigation module is added References See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304 If you have any questions or comments about this advisory please send us an Email or create a topic here.

Related

Alias · CVE (1)

  • CVE-2021-29506 GraphHopper is an open-source Java routing engine. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References