| Package | Affected versions | Patched versions |
|---|---|---|
| com.graphhopper:graphhopper-nav | < 2.4 | 2.4 |
| graphhopper | ≥ 2.0, < 2.4 | 2.4 |
The regex injection that may lead to Denial of Service.
Will be patched in 2.4 and 3.0
Versions lower than 2.x are only affected if the navigation module is added
See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304
If you have any questions or comments about this advisory please send us an Email or create a topic here.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free