Apache ShenYu (incubating) vulnerabilities

2 known vulnerabilities in Apache ShenYu (incubating) from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache ShenYu (incubating): Inefficient Regular Expression Complexity

  CVE-2022-26650May 17, 2022ApacheEPSS 2.66%

  In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions

• 7.5 High severity

  Apache ShenYu (incubating): Insufficiently Protected Credentials

  CVE-2022-23223Jan 25, 2022ApacheEPSS 4.31%

  On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.