CVE-2022-26650CWE-1333

CVE-2022-26650: vulnerability in Apache ShenYu (incubating)

Apache ShenYu (incubating) Regular expression denial of service

Published · Updated

Follow this CVE+ Monitor Apache ShenYu+ Monitor org.apache.shenyu:shenyu

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.7%
In short

Apache ShenYu's regex validation feature accepts user-controlled regular expressions without protection, allowing attackers to submit malicious regex patterns that consume excessive CPU resources and freeze the application.

Technical detail

RegexPredicateJudge.java directly passes user-supplied parameters to Pattern.matches() without validation or timeouts, enabling ReDoS (Regular Expression Denial of Service) attacks. An attacker can craft exponential backtracking patterns causing resource exhaustion and application unavailability.

Summary generated and translated by AI from the official description.
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.
Affected products
Apache Software Foundation · Apache ShenYu (incubating)
Related CVEs — Apache ShenYu (incubating)

In the same product, most dangerous first.

CVE-2022-23944—Apache ShenYu 2.4.1 Improper access controlEPSS 79.0%CVE-2021-45029—Apache ShenYu 2.4.1 Groovy Code Injection & SpEL InjectionEPSS 6.0%CVE-2022-23223—Apache ShenYu Password leakageEPSS 4.3%CVE-2022-23945—Apache ShenYu missing authentication allows gateway registrationEPSS 3.8%