Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-31781

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.

Published

2022-07-13T08:15:07.213

Last Modified

2024-11-21T07:05:18.387

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-1333
  • Type: Secondary
    CWE-1333
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache tapestry < 5.8.2 Yes
References