CVE Vulnerabilities

CVE-2020-26883

Uncontrolled Recursion

Published: Nov 06, 2020 | Modified: Nov 10, 2020
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.

Weakness

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Name Vendor Start Version End Version
Play_framework Lightbend * 2.6.25 (including)
Play_framework Lightbend 2.7.0 (including) 2.7.5 (including)
Play_framework Lightbend 2.8.0 (including) 2.8.2 (including)

Potential Mitigations

References