Read the docs
TI-2022-11713 Aliases CVE-2022-29169

ReDoS on endpoint html5client/useragent in BigBlueButton

Priority MEDIUM 42CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1333.

Summary

BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5 service. The useragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUserAgent() (alias of useragent.lookup() ). This function handles input by regexing and attackers can abuse that by providing some ReDos payload using `SmartWatch`. The maintainers removed `htmlclient/useragent` from versions 2.3.19, 2.4.7, and 2.5.0-beta.2. As a workaround, disable NginX forwarding the requests to the handler according to the directions in the GitHub Security Advisory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01586 75th percentileScored 2026-11-07
Fix Fixed bigbluebutton (bigbluebutton): 2.3.19, 2.4.7, 2.5.0-beta.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bigbluebuttonbigbluebutton2.2 to before 2.3.19; 2.4.0 to before 2.4.7; 2.5-alpha-1 to before 2.5.0-beta.22.3.19, 2.4.7, 2.5.0-beta.2Patch availableCNA
  • bigbluebutton Vendorbigbluebutton Affected 2.2 to before 2.3.19; 2.4.0 to before 2.4.7; 2.5-alpha-1 to before 2.5.0-beta.2 Fixed in 2.3.19, 2.4.7, 2.5.0-beta.2 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*2.2.0 to before 2.3.19; 2.4.0 to before 2.4.7Vulnerablebigbluebutton
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha1:*:*:*:*:*:*2.5 alpha1Vulnerablebigbluebutton
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha2:*:*:*:*:*:*2.5 alpha2Vulnerablebigbluebutton
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha3:*:*:*:*:*:*2.5 alpha3Vulnerablebigbluebutton
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha4:*:*:*:*:*:*2.5 alpha4Vulnerablebigbluebutton
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha5:*:*:*:*:*:*2.5 alpha5Vulnerablebigbluebutton
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha6:*:*:*:*:*:*2.5 alpha6Vulnerablebigbluebutton
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:beta1:*:*:*:*:*:*2.5 beta1Vulnerablebigbluebutton
  • cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.3.19; 2.4.0 to before 2.4.7 Vulnerable ·bigbluebutton
  • cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha1:*:*:*:*:*:* Versions 2.5 alpha1 Vulnerable ·bigbluebutton
  • cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha2:*:*:*:*:*:* Versions 2.5 alpha2 Vulnerable ·bigbluebutton
  • cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha3:*:*:*:*:*:* Versions 2.5 alpha3 Vulnerable ·bigbluebutton
  • cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha4:*:*:*:*:*:* Versions 2.5 alpha4 Vulnerable ·bigbluebutton
  • cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha5:*:*:*:*:*:* Versions 2.5 alpha5 Vulnerable ·bigbluebutton
  • cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha6:*:*:*:*:*:* Versions 2.5 alpha6 Vulnerable ·bigbluebutton
  • cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:beta1:*:*:*:*:*:* Versions 2.5 beta1 Vulnerable ·bigbluebutton

Remediation

  • Fix · CNA bigbluebutton (bigbluebutton) Fixed in 2.3.19, 2.4.7, 2.5.0-beta.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29169

References

Patch 3

  • TI-2026-21873 BigBlueButton: Exposed ClamAV port enables Denial of Service CVSS 3.1HIGH 8.2
  • TI-2025-38047 BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId CVSS 3.1HIGH 7.5
  • TI-2025-38046 BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation CVSS 3.1HIGH 7.5
  • TI-2022-13109 Cross site scripting in username that will trigger by sending chat CVSS 3.1MEDIUM 6.5
  • TI-2020-09954 BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the… CVSS 3.1CRITICAL 9.8
  • TI-2020-16722 BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents… CVSS 3.1CRITICAL 9.8
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences