CVE-2022-25598
Apache DolphinScheduler user registration is vulnerable to ReDoS attacks
CVE-2022-25598 is a high vulnerability (CVSS 7.5) in Apache Dolphinscheduler, published March 30, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.98%, the 80th percentile. Fixed in org.apache.dolphinscheduler:dolphinscheduler 2.0.5.
- Severity
- 7.5 HighCVSS 3.1, NVD
- Exploit chance
- 1.98%EPSS, 80th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.5org.apache.dolphinscheduler:dolphinscheduler +3 more
Description
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.dolphinscheduler:dolphinschedulerMaven | before 2.0.5 | 2.0.5 |
apache-dolphinschedulerPyPI | before 2.0.5 | 2.0.5 |
org.apache.dolphinscheduler:dolphinschedulerMaven | before 2.0.5, plus listed versions 1.2.01.2.11.3.01.3.11.3.2 Show 13 moreShow less1.3.31.3.41.3.51.3.61.3.71.3.81.3.92.0.02.0.0-alpha2.0.12.0.22.0.32.0.4 | 2.0.5 |
apache-dolphinschedulerPyPI | before 2.0.5, plus listed versions 0.1.00.1.1 | 2.0.5 |
What each source reports
NVD Score used
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- Record
CVE-2022-25598- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
CVE ListNo score
Apache DolphinScheduler user registration is vulnerable to ReDoS attacks
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- Record
CVE-2022-25598- Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2022-0021No score
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- Record
EUVD-2022-0021- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qg5x-66hp-cw5p
Uncontrolled Resource Consumption in Apache DolphinScheduler
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks. Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- Record
GHSA-qg5x-66hp-cw5p- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-1333
- Updated
- 2026-11-02
OSVGHSA-qg5x-66hp-cw5p
Uncontrolled Resource Consumption in Apache DolphinScheduler
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks. Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- Record
GHSA-qg5x-66hp-cw5p- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333, CWE-400
- Updated
- 2026-11-02
OSVNo score
Apache DolphinScheduler user registration is vulnerable to ReDoS attacks
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- Record
CVE-2022-25598- Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVPYSEC-2022-176No score
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- Record
PYSEC-2022-176- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread/hwnw7xr969sg5nv84wz75nfr2c76fl93
nvd.nist.gov/vuln/detail/CVE-2022-25598
github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2022-176.yaml