Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

TRUNG BÌNH 6.5CVE-2021-29506 · GHSA-hf44-3mx6-vhhw · Công bố 13/05/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-29506 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng com.graphhopper:graphhopper-nav, graphhopper (graphhopper).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.4%, cao hơn 72.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
com.graphhopper:graphhopper-nav Maven	`< 2.4`	`2.4`
graphhopper graphhopper	`≥ 2.0, < 2.4`	`2.4`

Mô tả

Impact

The regex injection that may lead to Denial of Service.

Patches

Will be patched in 2.4 and 3.0

Workarounds

Versions lower than 2.x are only affected if the navigation module is added

References

See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304

If you have any questions or comments about this advisory please send us an Email or create a topic here.

Mô tả của NVD

GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304