Regular expression denial of service in Delight Nashorn Sandbox

ALTO 7.5CVE-2021-40660 · GHSA-38j3-6fm8-pfgc · Published 14/06/2022 · updated 17/06/2026

In breve

CVE-2021-40660 è una vulnerabilità ALTO (CVSS 7.5) che riguarda org.javadelight:delight-nashorn-sandbox, nashorn sandbox (javadelight).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.0%, superiore al 64.1% delle vulnerabilità.
Correzione: aggiornare a 0.3.1 o successiva.

Package	Affected versions	Patched versions
org.javadelight:delight-nashorn-sandbox Maven	`< 0.3.1`	`0.3.1`
nashorn sandbox javadelight	`= 0.2.0`	No fix yet

Description

An issue was discovered in Delight Nashorn Sandbox. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.

NVD description

An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.

References

nvd.nist.gov/vuln/detail/CVE-2021-40660 · ADVISORY
javadelight/delight-nashorn-sandbox · WEB
javadelight/delight-nashorn-sandbox · WEB
javadelight/delight-nashorn-sandbox#139 · WEB
javadelight/delight-nashorn-sandbox commit b899b8e · WEB
javadelight/delight-nashorn-sandbox · PACKAGE
javadelight/delight-nashorn-sandbox release 0.3.1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free