CVE-2022-26650 — HIGH (7.5)

Vulnerability Description

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Apache	Shenyu	2.4.0

Related Weaknesses (CWE)

CWE-1333

References

http://www.openwall.com/lists/oss-security/2022/05/17/3Mailing ListPatchThird Party Advisory
https://lists.apache.org/thread/8rp33m3nm4bwtx3qx76mqynth3t3d673Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2022/05/17/3Mailing ListPatchThird Party Advisory
https://lists.apache.org/thread/8rp33m3nm4bwtx3qx76mqynth3t3d673Mailing ListVendor Advisory

FAQ

What is CVE-2022-26650?

CVE-2022-26650 is a vulnerability with a CVSS score of 7.5 (HIGH). In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This ...

How severe is CVE-2022-26650?

CVE-2022-26650 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-26650?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Shenyu.