CVE-2020-26883: Uncontrolled Recursion in Play Framework
Summary
CVE-2020-26883: Uncontrolled Recursion in Play Framework. Affects com.typesafe.play:play across 2 version ranges.
>= 2.6.0, < 2.7.6
>= 2.8.0, < 2.8.3
Fixed in 2.7.6 or 2.8.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Play Framework is a web application framework written in Scala and Java. It provides a set of tools and libraries for building scalable and efficient web applications. The framework is widely used in the Java and Scala communities and offers features such as routing, templating, and data binding. However, versions 2.6.0 through 2.8.2 of the Play Framework are vulnerable to uncontrolled recursion during the parsing of crafted JSON documents.
Vulnerability Detail
The vulnerability in the Play Framework allows for stack consumption due to unbounded recursion when parsing specially crafted JSON documents. This can lead to a denial of service (DoS) attack, as an attacker can send a malicious JSON payload that causes the application to consume excessive stack space, resulting in the application crashing or becoming unresponsive. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.6.0, < 2.7.62.7.6 -
>= 2.8.0, < 2.8.32.8.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a secure version of the Play Framework.
Conclusion
The Play Framework is vulnerable to uncontrolled recursion when parsing crafted JSON documents, leading to a denial of service (DoS) attack. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of the Play Framework. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.typesafe.play:play →
FAQ
The vulnerability can lead to a denial of service (DoS) attack, causing the application to crash or become unresponsive.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
No, only versions 2.6.0 through 2.8.2 of the Play Framework are vulnerable. It is recommended to upgrade to a fixed version to mitigate the risk.
No, there is no known workaround. Upgrading to a secure version is the recommended solution.
The CVSS score of this vulnerability is 7.5, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for com.typesafe.play:play.
