CVE-2022-31781: Apache Tapestry 5.8.1 - ReDoS via Content Types
Summary
CVE-2022-31781: Apache Tapestry 5.8.1 vulnerable to ReDoS via Content Types causing catastrophic backtracking. Affects org.apache.tapestry:tapestry-core versions < 5.8.2. Fixed in 5.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tapestry is an open-source component-oriented web application framework for Java. It provides a highly modular and flexible architecture for building web applications. The vulnerable version, Apache Tapestry 5.8.1, is susceptible to a Regular Expression Denial of Service (ReDoS) attack when handling Content Types. This vulnerability can lead to catastrophic backtracking, causing the application to take an exponential amount of time to complete certain operations. The specific vulnerability lies in the regular expression used in the org.apache.tapestry5.http.ContentType class. It's important to note that this vulnerability can only be triggered if there is non-Tapestry code passing external input to the ContentType class constructor.
Vulnerability Detail
The vulnerability in Apache Tapestry 5.8.1 allows for a ReDoS attack through specially crafted Content Types. By exploiting this vulnerability, an attacker can cause the application to enter a state of catastrophic backtracking, resulting in significant performance degradation or even denial of service. The regular expression used in the ContentType class parameter is the root cause of this vulnerability. It is worth mentioning that this vulnerability cannot be triggered solely through web requests in Tapestry code; it requires external input passed to the ContentType class constructor through non-Tapestry codepaths. Apache Tapestry 5.8.2 includes a fix for this vulnerability.
How To Fix
Latest published version: 5.9.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.8.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As this vulnerability requires external input passed to the ContentType class constructor through non-Tapestry codepaths, a potential workaround is to thoroughly validate and sanitize any input before passing it to the constructor. By implementing strict input validation and filtering mechanisms, you can reduce the risk of triggering the vulnerability. However, it is important to note that this workaround is not a comprehensive solution and should be considered temporary. Upgrading to Apache Tapestry 5.8.2 or later is still the recommended approach for complete vulnerability mitigation.
Conclusion
The vulnerability in Apache Tapestry 5.8.1 allows for a ReDoS attack through specially crafted Content Types. Upgrading to Apache Tapestry version 5.8.2 or later is the recommended solution to mitigate this vulnerability. It is also important to review and validate any non-Tapestry codepaths that pass external input to the ContentType class constructor. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tapestry:tapestry-core →
FAQ
Apache Tapestry is an open-source component-oriented web application framework for Java. It provides a modular and flexible architecture for building web applications.
A Regular Expression Denial of Service (ReDoS) attack is a type of vulnerability where a maliciously crafted input can cause a regular expression pattern to take an excessive amount of time to process, leading to performance degradation or denial of service.
The vulnerability in Apache Tapestry 5.8.1 can lead to catastrophic backtracking, causing significant performance degradation or denial of service. It can be exploited by passing specially crafted Content Types to the ContentType class constructor through non-Tapestry codepaths.
No, this vulnerability can only be triggered if there is external input passed to the ContentType class constructor through non-Tapestry codepaths. Web requests in Tapestry code alone cannot trigger this vulnerability.
To protect your application from this vulnerability, it is recommended to upgrade to Apache Tapestry version 5.8.2 or later. Additionally, ensure that any non-Tapestry codepaths passing external input to the ContentType class constructor have proper input validation and sanitization measures in place.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tapestry:tapestry-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
