CVE-2021-29506mediumCWE-400

CVE-2021-29506: falha de média gravidade em graphhopper

Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar graphhopper+ Monitorar com.graphhopper:graphhopper-nav

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 1.4%
GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
graphhopper · graphhopper