CVE-2022-29158

Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz

At a glance

Severity: Not available
EPSS: EPSS 2.18 % · percentile 82 (2026-10-27)
State: PUBLISHED
Published: 2022-09-02
Updated: 2024-08-03
Assigner: apache
NVD status: Modified

Description

Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-1333

European references

ENISA EUVD · EUVD-2022-33566
GCVE · GCVE-0-2022-29158

Affected configurations (NVD CPE)

cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* < 18.12.06

Affected products

Product	Versions
Apache Software Foundation · Apache OFBiz	affected Apache OFBiz ≤ 18.12.05

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD