CVE-2009-1190 — Regex Denial of Service in JDK

CWE-1333 — Regex Denial of Service6 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
1.4%
top 19.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
SUN JDK
Timeline
PublishedApr 27
Latest updateMay 2

Description

Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDsun/jdk1.5.0+78

🔴Vulnerability Details

3
GHSA
Spring Framework Inefficient Regular Expression Complexity↗2022-05-02
▶
OSV
Spring Framework Inefficient Regular Expression Complexity↗2022-05-02
▶
CVEList
CVE-2009-1190: Algorithmic complexity vulnerability in the java↗2009-04-27
▶

📋Vendor Advisories

1
Red Hat
Spring Framework Remote Denial of Service vulnerability↗2009-04-22
▶

💬Community

1
Bugzilla
CVE-2009-1190 Spring Framework Remote Denial of Service vulnerability↗2009-04-22
▶
CVE-2009-1190 — Regex Denial of Service in SUN JDK | cvebase