Read the docs
TI-2022-13675 Aliases CVE-2022-31781GHSA-227g-7cvv-6ff3

Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)

Priority LOW 37CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.

Why it matters now

EPSS 0.01973 80th percentileScored 2026-11-07
Fix Fixed Apache Tapestry (Apache Software Foundation): 5.8.1org.apache.tapestry:tapestry-core (Maven): 5.8.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tapestry5.8.1 to before 5.8.15.8.1Patch availableCNA
—org.apache.tapestry:tapestry-core (Maven)before 5.8.25.8.2Patch availableGHSA-227g-7cvv-6ff3
  • Apache Tapestry VendorApache Affected 5.8.1 to before 5.8.1 Fixed in 5.8.1 Patch available CNA
  • org.apache.tapestry:tapestry-core (Maven) Vendor— Affected before 5.8.2 Fixed in 5.8.2 Patch available GHSA-227g-7cvv-6ff3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:*before 5.8.2VulnerableApache
  • cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:* Versions before 5.8.2 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Tapestry (Apache Software Foundation) Fixed in 5.8.1
  • Fix · GHSA-227g-7cvv-6ff3 org.apache.tapestry:tapestry-core (Maven) Fixed in 5.8.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31781
  2. 2026-10-03 Alias added: GHSA-227g-7cvv-6ff3

References

Advisory 2

Other 1

  • TI-2021-09208 Bypass of the fix for CVE-2019-0195 CVSS 3.1CRITICAL 9.8
  • TI-2019-00172 Deserialization of untrusted data in Apache Tapestry CVSS 3.1CRITICAL 9.8
  • TI-2020-13279 Deserialization flaw in EOL Tapestry 4. CVSS 3.1CRITICAL 9.8
  • TI-2019-07397 Observable discrepancy in Apache Tapestry CVSS 3.1CRITICAL 9.8
  • TI-2022-22909 Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input CVSS 3.1CRITICAL 9.8
  • TI-2014-01541 Apache Tapestry before 5.3.6 relies on client-side object storage without checking… CVSS 2.0HIGH 7.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences