CVE-2021-29506: Regex Injection Vulnerability in com.graphhopper:graphhopper-nav
Summary
CVE-2021-29506: Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service. Affects com.graphhopper:graphhopper-nav versions < 2.4. Fixed in 2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
com.graphhopper:graphhopper-nav is a Maven package that provides navigation functionality. It is used to calculate routes and provide navigation instructions. The package is vulnerable to a regex injection vulnerability in the Navigate endpoint, which can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The regex injection vulnerability in com.graphhopper:graphhopper-nav allows an attacker to inject malicious regex patterns into the Navigate endpoint. This can cause the application to enter into an infinite loop or consume excessive resources, resulting in a DoS condition. The vulnerability can be exploited by sending specially crafted requests to the Navigate endpoint.
How To Fix
Latest published version: 12.0-pre2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to version 2.4 or higher is not feasible, a workaround is to avoid using the Navigate endpoint or disable the navigation module in versions lower than 2.x. This will prevent the vulnerability from being exploited.
Conclusion
The regex injection vulnerability in com.graphhopper:graphhopper-nav can lead to a Denial of Service (DoS) attack. It is recommended to update to version 2.4 or higher to fix this vulnerability. If updating is not possible, disabling the navigation module can provide a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.graphhopper:graphhopper-nav →
FAQ
com.graphhopper:graphhopper-nav is a Maven package that provides navigation functionality, including route calculation and navigation instructions.
The vulnerability allows an attacker to perform regex injection, which can lead to a Denial of Service (DoS) attack by causing the application to enter into an infinite loop or consume excessive resources.
To fix this vulnerability, update to version 2.4 or higher of com.graphhopper:graphhopper-nav. The fix is included in versions 2.4 and 3.0.
Versions lower than 2.x are only affected if the navigation module is added. Disabling the navigation module can mitigate the vulnerability.
You can find more information about the fix in the pull request: https://github.com/graphhopper/graphhopper/pull/2304
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
