CVE-2022-29169: ReDoS on endpoint html5client/useragent in BigBlueButton

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-01 · updated 2026-06-17
Weakness: CWE-20

Description

BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5 service. The useragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUserAgent() (alias of useragent.lookup() ). This function handles input by regexing and attackers can abuse that by providing some ReDos payload using `SmartWatch`. The maintainers removed `htmlclient/useragent` from versions 2.3.19, 2.4.7, and 2.5.0-beta.2. As a workaround, disable NginX forwarding the requests to the handler according to the directions in the GitHub Security Advisory.

Affected products

bigbluebutton: from 2.2.0 before 2.3.19; from 2.4.0 before 2.4.7; 2.5-alpha1, 2.5-alpha2, 2.5-alpha3, 2.5-alpha4, 2.5-alpha5, 2.5-alpha6 (+1) — fixed in 2.3.19, 2.4.7

How to fix

Upgrade to a fixed version: bigbluebutton 2.3.19, 2.4.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-29169 or the next vulnerability affects your stack