CVE-2022-26650: Apache ShenYu (incubating) Regular expression denial of service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-17 · updated 2026-06-17
Weakness: CWE-1333

Description

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.

Affected products

Apache Software Foundation Apache ShenYu (incubating): 2.4.0, 2.4.1, 2.4.2

References

http://www.openwall.com/lists/oss-security/2022/05/17/3
https://lists.apache.org/thread/8rp33m3nm4bwtx3qx76mqynth3t3d673
http://www.openwall.com/lists/oss-security/2022/05/17/3
https://lists.apache.org/thread/8rp33m3nm4bwtx3qx76mqynth3t3d673

Get alerted when CVE-2022-26650 or the next vulnerability affects your stack