CVE-2022-31781

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-31781

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31781.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-31781

Aliases

GHSA-227g-7cvv-6ff3

Published

2022-07-13T07:25:10Z

Modified

2026-08-12T03:51:35Z

Summary

Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)

Details

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-1333"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31781.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.8.1"
                },
                {
                    "last_affected": "5.8.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/apache/tapestry-5

Affected ranges

Type

GIT

Repo

https://github.com/apache/tapestry-5

Events

Introduced

Fixed

55553dd773f0b8d7f2f0dfafbf72bbebd0206bef

Database specific

Show details

{
    "cpe": "cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.8.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

5.*

5.4-alpha-1

5.4-alpha-10

5.4-alpha-11

5.4-alpha-12

5.4-alpha-13

5.4-alpha-14

5.4-alpha-15

5.4-alpha-16

5.4-alpha-17

5.4-alpha-18

5.4-alpha-19

5.4-alpha-2

5.4-alpha-20

5.4-alpha-21

5.4-alpha-24

5.4-alpha-25

5.4-alpha-26

5.4-alpha-27

5.4-alpha-28

5.4-alpha-29

5.4-alpha-3

5.4-alpha-7

5.4-alpha-8

5.4-alpha-9

5.4-beta-1

5.4-beta-10

5.4-beta-13

5.4-beta-14

5.4-beta-15

5.4-beta-16

5.4-beta-17

5.4-beta-18

5.4-beta-19

5.4-beta-2

5.4-beta-20

5.4-beta-22

5.4-beta-23

5.4-beta-3

5.4-beta-33

5.4-beta-34

5.4-beta-35

5.4-beta-36

5.4-beta-37

5.4-beta-38

5.4-beta-6

5.4-beta-8

5.4-beta-9

5.4-rc-1

5.4.0

5.4.1

5.5.0

5.5.0-alpha-1

5.5.0-alpha-10

5.5.0-alpha-2

5.5.0-alpha-3

5.5.0-alpha-4

5.5.0-alpha-5

5.5.0-alpha-6

5.5.0-alpha-7

5.5.0-alpha-8

5.5.0-alpha-9

5.5.0-beta-1

5.5.0-beta-2

5.6.0

5.7.0

5.7.1

5.7.2

5.7.3

5.8.0

5.8.1

v5.*

v5.5.0-beta-3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31781.json"