CVE-2021-29506

Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

Description

GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304

Category

6.5
CVSS
Severity: Medium
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.38%
Third-Party Advisory github.com Third-Party Advisory github.com Third-Party Advisory github.com
Affected: graphhopper graphhopper
Published at:
Updated at:

References

Link Tags
https://github.com/graphhopper/graphhopper/security/advisories/GHSA-hf44-3mx6-vhhw third party advisory
https://github.com/graphhopper/graphhopper/pull/2304 third party advisory patch
https://github.com/graphhopper/graphhopper/commit/eb189be1fa7443ebf4ae881e737a18f818c95f41 third party advisory patch

Frequently Asked Questions

What is the severity of CVE-2021-29506?
CVE-2021-29506 has been scored as a medium severity vulnerability.
How to fix CVE-2021-29506?
To fix CVE-2021-29506, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2021-29506 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2021-29506 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2021-29506?
CVE-2021-29506 affects graphhopper graphhopper.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.