CVE-2022-31023: Dev error stack trace leaking into prod in Play Framework
Summary
CVE-2022-31023: Dev error stack trace leaking into prod in Play Framework. Affects com.typesafe.play:play_2.12 versions < 2.8.16. Fixed in 2.8.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Play Framework is an open-source web application framework that is written in Scala and Java. It provides a set of tools and libraries for building web applications. Play Framework allows developers to build scalable and efficient web applications by following the MVC (Model-View-Controller) architectural pattern. It is widely used in the development of web applications and APIs. However, a vulnerability has been discovered in Play Framework that can lead to the leakage of dev error stack traces into production environments.
Vulnerability Detail
The vulnerability in Play Framework occurs when the application is run in dev mode or when the DefaultHttpErrorHandler object is improperly configured as the injected error handler. In these situations, verbose errors containing exception stack traces may be displayed to users in a production application. This can expose sensitive information from the application, potentially leading to security breaches or unauthorized access to sensitive data. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Latest published version: 2.8.22 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Play Framework is not immediately feasible, a workaround for this vulnerability is to ensure that a properly-configured error handler is passed when constructing a CORSFilter or CORSActionBuilder. This can be done by using the HttpErrorHandler instance provided through dependency injection or through Play's BuiltInComponents. It is important to ensure that the application does not use the DefaultHttpErrorHandler static object in any code that may be run in production.
Conclusion
The vulnerability in Play Framework that allows dev error stack traces to leak into prod environments can be mitigated by updating to version 2.8.16 or later. Alternatively, a workaround can be implemented by ensuring the use of a properly-configured error handler. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.typesafe.play:play_2.12 →
FAQ
Play Framework is an open-source web application framework that allows developers to build scalable and efficient web applications using Scala and Java.
The vulnerability can result in verbose errors displaying to users in a production application, potentially exposing sensitive information from the application.
To fix this vulnerability, update Play Framework to version 2.8.16 or later.
Yes, a workaround is to ensure that a properly-configured error handler is passed when constructing a CORSFilter or CORSActionBuilder.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.typesafe.play:play_2.12.
