GHSA-hf44-3mx6-vhhw
Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.graphhopper:graphhopper-nav | < 2.4 | 2.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The regex injection that may lead to Denial of Service.
### Patches
Will be patched in 2.4 and 3.0
### Workarounds
Versions lower than 2.x are only affected if the navigation module is added
### References
See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304
If you have any questions or comments about this advisory please [send us an Email](https://www.graphhopper.com/contact-form/) or create a topic [here](https://discuss.graphhopper.com/).
References
External links from the advisory. They lead to third-party sites.