Observable discrepancy in Apache Tapestry
Priority MEDIUM 53CWE-203Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-203.
Summary
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.
Why it matters now
EPSS 0.08752 95th percentileScored 2026-11-07
Fix Fixed org.apache.tapestry:tapestry-core (Maven): 5.4.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tapestry | Apache Tapestry 5.4.0 to 5.4.3 | — | No fix listed | CNA |
| — | org.apache.tapestry:tapestry-core (Maven) | 5.4 to before 5.4.5 | 5.4.5 | Patch available | GHSA-fgmr-vx7c-5wj6 |
- Apache Tapestry VendorApache Affected Apache Tapestry 5.4.0 to 5.4.3 Fixed in — No fix listed CNA
- org.apache.tapestry:tapestry-core (Maven) Vendor— Affected 5.4 to before 5.4.5 Fixed in 5.4.5 Patch available GHSA-fgmr-vx7c-5wj6
Remediation
- Fix · GHSA-fgmr-vx7c-5wj6 org.apache.tapestry:tapestry-core (Maven) Fixed in 5.4.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10071
- 2026-10-03 Alias added: GHSA-fgmr-vx7c-5wj6
References
Other 10
- [tapestry-users] 20190913 CVE-2019-10071: Apache Tapestry vulnerability disclosure
- [tapestry-users] 20191007 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure
- [tapestry-users] 20191014 Re: CVE-2019-10071: Apache Tapestry vulnerability disclosure
- [tapestry-commits] 20200111 svn commit: r1055136 [2/2] - in /websites/production/tapestry/content: cache/main.pageCache component-rendering.html content-type-and-markup.html dom.html https.html request-processing.html response-compression.html security.html url-rewriting.html
- [tapestry-commits] 20200531 svn commit: r1061326 [4/4] - in /websites/production/tapestry/content: ./ cache/
- https://lists.apache.org/thread.html/6e8f42c88da7be3c60aafe3f6a85eb00b4f8b444de26b38d36233a43@%3Cusers.tapestry.apache.org%3E
- https://lists.apache.org/thread.html/7a437dad5af7309aba4d01bfc2463b3ac34e6aafaa565381d3a36460@%3Cusers.tapestry.apache.org%3E
- https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c@%3Cusers.tapestry.apache.org%3E
- https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c@%3Ccommits.tapestry.apache.org%3E
- https://lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068dc30843@%3Ccommits.tapestry.apache.org%3E
More Apache Tapestry vulnerabilities
- TI-2021-09208 Bypass of the fix for CVE-2019-0195 CVSS 3.1CRITICAL 9.8
- TI-2019-00172 Deserialization of untrusted data in Apache Tapestry CVSS 3.1CRITICAL 9.8
- TI-2020-13279 Deserialization flaw in EOL Tapestry 4. CVSS 3.1CRITICAL 9.8
- TI-2022-22909 Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input CVSS 3.1CRITICAL 9.8
- TI-2014-01541 Apache Tapestry before 5.3.6 relies on client-side object storage without checking… CVSS 2.0HIGH 7.8
- TI-2021-11029 An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later CVSS 3.1HIGH 7.5
Sources
- CVE-2019-10071 · CVE Program
- CVE-2019-10071 · NVD
- FIRST EPSS
- GHSA-fgmr-vx7c-5wj6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences