high7.5
CVE-2020-27196
An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2.
Impact
An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint (that may or may not expect JSON payloads) causes a StackOverflowError and Denial of Service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lightbend | Play Framework | through 2.6.25 from 2.7.0 through 2.7.5 from 2.8.0 through 2.8.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.playframework.com/security/vulnerability
- https://www.playframework.com/security/vulnerability/CVE-2020-27196-DosViaJsonStackOverflow
- https://www.playframework.com/security/vulnerability
- https://www.playframework.com/security/vulnerability/CVE-2020-27196-DosViaJsonStackOverflow