{"id":"CVE-2021-23408","aliases":["EUVD-2021-1845","GHSA-qhxh-9hhx-6p7v","SNYK-JAVA-COMGRAPHHOPPER-1320114"],"status":"published","title":"Prototype Pollution","description":"This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01401,"percentile":0.72863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2021-07-21T15:35:12Z","modified":"2026-10-20T10:54:34Z","fixes":[{"ecosystem":"Maven","package":"com.graphhopper:graphhopper-web-bundle","fixed_in":["3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.graphhopper:graphhopper-web-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.graphhopper:graphhopper-web-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2"}]}],"versions":["0.11.0","0.11.0-pre1","0.11.0-pre2","0.11.0-pre3","0.11.0-pre4","0.11.0-pre5","0.11.0-pre6","0.12.0","0.12.0-pre1","0.12.0-pre2","0.12.0-pre3","0.12.0-pre5","0.12.0-pre6","0.12.0-pre7","0.13.0","0.13.0-pre1","0.13.0-pre10","0.13.0-pre12","0.13.0-pre13","0.13.0-pre14","0.13.0-pre16","0.13.0-pre17","0.13.0-pre18","0.13.0-pre19","0.13.0-pre2","0.13.0-pre3","0.13.0-pre4","0.13.0-pre5","0.13.0-pre6","0.13.0-pre7","0.13.0-pre8","0.13.0-pre9","0.13.0-tardur1","0.13.0-tmp-cleanhack","0.14.0-pre1","1.0","1.0-pre1","1.0-pre10","1.0-pre11","1.0-pre12","1.0-pre13","1.0-pre14","1.0-pre15","1.0-pre16","1.0-pre17","1.0-pre18","1.0-pre19","1.0-pre2","1.0-pre20","1.0-pre21","1.0-pre22","1.0-pre23","1.0-pre24","1.0-pre25","1.0-pre26","1.0-pre27","1.0-pre28","1.0-pre29","1.0-pre3","1.0-pre30","1.0-pre30.2","1.0-pre30.3","1.0-pre31","1.0-pre32","1.0-pre32.1","1.0-pre33","1.0-pre33.2","1.0-pre33.3","1.0-pre33.4","1.0-pre34","1.0-pre35","1.0-pre36","1.0-pre37","1.0-pre38","1.0-pre39","1.0-pre4","1.0-pre40","1.0-pre41","1.0-pre42","1.0-pre43","1.0-pre5","1.0-pre6","1.0-pre7","1.0-pre9","1.0-prelmfix","2.0","2.0-pre2","2.0-pre3","2.1","2.2","2.3","2.4","3.0","3.0-pre1","3.0-pre2","3.0-pre3","3.0-pre4","3.0-pre5","client_hc_no_vehicle","feature_1850_01","feature_1850_02","profiles_01","stable"]}],"products":[{"vendor":"graphhopper","product":"graphhopper"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JAVA-COMGRAPHHOPPER-1320114","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/graphhopper/graphhopper/pull/2370","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/graphhopper/graphhopper/releases/tag/3.2","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/graphhopper/graphhopper/releases/tag/3.1","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23408","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qhxh-9hhx-6p7v"}],"sources":{"cve":[{"id":"CVE-2021-23408","title":"Prototype Pollution","description":"This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.","status":"published","published":"2021-07-21T15:35:12.141Z","modified":"2024-09-16T18:44:49.582Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2021-1845","description":"This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.","status":"published","published":"2021-07-21T15:35:12Z","modified":"2024-09-16T18:44:49Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:29.674428Z"}],"ghsa":[{"id":"GHSA-qhxh-9hhx-6p7v","title":"Prototype Pollution in GraphHopper","description":"This affects the package `com.graphhopper:graphhopper-web-bundle` before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.","status":"published","published":"2021-08-02T16:59:35Z","modified":"2023-02-01T05:05:54Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:36:35.781528Z"}],"nvd":[{"id":"CVE-2021-23408","description":"This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.","status":"published","published":"2021-07-21T16:15:08.613Z","modified":"2026-06-17T03:38:42.6Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"CVE-2021-23408","description":"This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.","status":"published","published":"2021-07-21T16:15:08.613Z","modified":"2026-10-20T10:54:34.523829876Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"GHSA-qhxh-9hhx-6p7v","title":"Prototype Pollution in GraphHopper","description":"This affects the package `com.graphhopper:graphhopper-web-bundle` before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.","status":"published","published":"2021-08-02T16:59:35Z","modified":"2026-07-08T06:49:31.391180521Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:54.760124Z"}]}}