CVE-2022-26650

Katalog CVE

CVSS 7.5 · High EPSS 2,7%

Kerentanan Inefficient Regular Expression Complexity pada apache shenyu. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.

Rincian

Terbit di NVD

17 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/8rp33m3nm4bwtx3qx76mqynth3t3d673 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/05/17/3 mailing list · patch · advisory pihak ketiga