CVE-2022-31781
highpriority · track · 31EPSS 0.020 · 80 %ileEUUSEPSS · scored 2026-10-27
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-227g-7cvv-6ff3Apache Tapestry 5.8.1 vulnerable to ReDoS via Content Types causing catastrophic backtracking2022-07-14ghsa · osvUS
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-31781/cnnvd
- https://tapestry.apache.org/2022/06/20/tapestry-582-released.htmlPatchcnnvd
- https://www.cybersecurity-help.cz/vdb/SB2022071432cnnvd
- https://www.openwall.com/lists/oss-security/2022/07/12/3cnnvd
- https://www.openwall.com/lists/oss-security/2022/07/12/3enisa_euvd
- https://www.openwall.com/lists/oss-security/2022/07/12/3Mailing ListVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan