What is GHSA-hf44-3mx6-vhhw?

GHSA-hf44-3mx6-vhhw is a security advisory published by GitHub Security Advisories with Medium severity. Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

Which CVE IDs does GHSA-hf44-3mx6-vhhw cover?

GHSA-hf44-3mx6-vhhw covers the following CVE IDs: CVE-2021-29506. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hf44-3mx6-vhhw?

GHSA-hf44-3mx6-vhhw has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-hf44-3mx6-vhhw?

GHSA-hf44-3mx6-vhhw affects 1 product, including: maven/com.graphhopper:graphhopper-nav:\u003c 2.4.

GHSA-hf44-3mx6-vhhwMediumCVSS 6.5

Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

Vendor

GitHub Security Advisories

Published

May 19, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-29506 →

📋 Description

Impact

The regex injection that may lead to Denial of Service.

Patches

Will be patched in 2.4 and 3.0

Workarounds

Versions lower than 2.x are only affected if the navigation module is added

References

See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304

If you have any questions or comments about this advisory please send us an Email or create a topic here.

🎯 Affected products1

maven/com.graphhopper:graphhopper-nav:< 2.4

🔗 References (5)

https://github.com/graphhopper/graphhopper/security/advisories/GHSA-hf44-3mx6-vhhw
https://nvd.nist.gov/vuln/detail/CVE-2021-29506
https://github.com/graphhopper/graphhopper/pull/2304
https://github.com/graphhopper/graphhopper/commit/eb189be1fa7443ebf4ae881e737a18f818c95f41
https://github.com/advisories/GHSA-hf44-3mx6-vhhw