CVE-2022-25881

http-cache-semantics vulnerable to Regular Expression Denial of Service in maven/org.webjars.npm/http-cache-semantics

Identifiers

GHSA-rc47-6667-2j5j, CVE-2022-25881

Package Slug

maven/org.webjars.npm/http-cache-semantics

Vulnerability

http-cache-semantics vulnerable to Regular Expression Denial of Service

Description

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Affected Versions

All versions before 4.1.1

Solution

Upgrade to version 4.1.1 or above.

Last Modified

2023-02-02

source