CVE-2022-26650 Apache ShenYu (incubating) Regular expression denial of service

What is CVE-2022-26650?

CVE-2022-26650 is a high-severity denial of service vulnerability in Apache ShenYu (incubating), published on 17 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.

Weakness: CWE-1333

Which versions are affected by CVE-2022-26650?

4 open source packages ship an affected version, including org.apache.shenyu:shenyu and org.apache.shenyu:shenyu-bootstrap. It affects 1 product.

Products include Apache Shenyu.

How do I fix CVE-2022-26650?

Upgrade org.apache.shenyu:shenyu to 2.4.3 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-26650 being exploited?

There is no known exploitation of CVE-2022-26650 in the wild and no public exploit code.

Other vulnerabilities in Apache ShenYu (incubating)

• CVE-2021-45029 Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection Critical 9.8
• CVE-2021-37580 Apache ShenYu Admin bypass JWT authentication Critical 9.8
• CVE-2022-23944 Apache ShenYu 2.4.1 Improper access control Critical 9.1
• CVE-2022-42735 Apache ShenYu Admin ultra vires High 8.8
• CVE-2022-37435 Apache ShenYu Admin Improper Privilege Management High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cw56-j3fm-7w57.