{"id":"CVE-2022-29158","aliases":["EUVD-2022-33566","GHSA-7hxq-2vp3-4xmj"],"status":"published","title":"Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz","description":"Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0218,"percentile":0.82486,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1333"],"published":"2022-09-02T07:10:20Z","modified":"2026-10-28T02:30:31Z","products":[{"vendor":"apache","product":"ofbiz"},{"vendor":"apache software foundation","product":"apache ofbiz"}],"references":[{"url":"https://lists.apache.org/thread/7k92rg1o4ql2yw3o0vttkcl2jhq7j928","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/02/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29158","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7hxq-2vp3-4xmj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29158.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-29158","title":"Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz","description":"Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599","status":"published","published":"2022-09-02T07:10:20Z","modified":"2024-08-03T06:10:59.432Z","cwes":["CWE-1333"],"updated_at":"2026-11-02T14:34:36.270817Z"}],"euvd":[{"id":"EUVD-2022-33566","description":"Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599","status":"published","published":"2022-09-02T07:10:20Z","modified":"2024-08-03T06:10:59Z","updated_at":"2026-11-03T03:25:39.28463Z"}],"ghsa":[{"id":"GHSA-7hxq-2vp3-4xmj","title":"Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS)...","description":"Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599","status":"published","published":"2022-09-03T00:00:25Z","modified":"2023-07-30T05:02:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:54:43.067561Z"}],"nvd":[{"id":"CVE-2022-29158","description":"Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599","status":"published","published":"2022-09-02T07:15:07.63Z","modified":"2026-06-17T04:39:42.217Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"CVE-2022-29158","title":"Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz","description":"Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599","status":"published","published":"2022-09-02T07:10:20Z","modified":"2026-10-28T02:30:31.267597136Z","cwes":["CWE-1333"],"updated_at":"2026-11-02T15:44:25.164673Z"}]}}