oss-sec mailing list archives
CVE-2022-26650: Apache ShenYu (incubating) Regular expression denial of service
From: Zhang Yonglun <zhangyonglun () apache org>
Date: Tue, 17 May 2022 13:50:48 +0800
Severity: moderate Description: In ShenYu-Bootstrap there's RegexPredicateJudge.java which uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2. Mitigation: Upgrade to Apache ShenYu (incubating) 2.4.3 or apply patch https://github.com/apache/incubator-shenyu/pull/2975. -- Zhang Yonglun Apache ShenYu (Incubating) Apache ShardingSphere
Current thread:
- CVE-2022-26650: Apache ShenYu (incubating) Regular expression denial of service Zhang Yonglun (May 17)