ReDOS in Vfsjfilechooser2

HIGH 7.5CVE-2021-29061 · GHSA-c7fh-chf7-jr5x · Published 21/06/2021 · updated 17/06/2026

In short

CVE-2021-29061 is a HIGH (CVSS 7.5) vulnerability affecting com.github.fracpete:vfsjfilechooser2, vfsjfilechooser2 (vfsjfilechooser2 project).
Chance of exploitation in the next 30 days (EPSS): 2.3%, higher than 83.5% of all vulnerabilities.
Fix: update to 0.2.9 or later.

Package	Affected versions	Patched versions
com.github.fracpete:vfsjfilechooser2 Maven	`< 0.2.9`	`0.2.9`
vfsjfilechooser2 vfsjfilechooser2_project	`≤ 0.2.9`	No fix yet

Description

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 which occurs when the application attempts to validate crafted URIs.

NVD description

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 version 0.2.9 and below which occurs when the application attempts to validate crafted URIs.

References

nvd.nist.gov/vuln/detail/CVE-2021-29061 · ADVISORY
fracpete/vfsjfilechooser2 · WEB
fracpete/vfsjfilechooser2 commit 9c9f2c3 · WEB
fracpete/vfsjfilechooser2 release vfsjfilechooser2-0.2.9 · WEB
yetingli/PoCs · WEB
yetingli/SaveResults · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free