HIGH 7.5 Maven
Apache IoTDB subject to ReDOS with Java 8
GHSA-g6hg-4v3c-6jq7 · CVE-2022-43766 · PYSEC-2022-42972
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it.
Ready to move
Start Securing
Free, no credit card | First findings in minutes