-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the regex pattern in ContentType's constructor. The original pattern used '(; (param=value))' with an unbounded quantifier (), which is vulnerable to ReDoS via exponential backtracking. The commit 3c8d610 shows the fix was to limit parameters to {0,5} repetitions. The added test case demonstrates this by triggering a timeout with excessive parameters. Since the constructor directly processes input using this regex, it's the clear vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tapestry:tapestry-core | maven | < 5.8.2 | 5.8.2 |
JavaJavaOngoing coverage of React2Shell