Not rated
CVE-2021-33580 User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to…
Description
User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side. This problem has been fixed in Roller 6.0.2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Roller 6.0 | earliest → < 6.0.2 | 6.0.2 |
References
- lists.apache.org lists.apache.org
- [oss-security] 20210817 CVE-2021-33580: Apache Roller: regex injection leading to DoS www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache Roller
The 24 CVEs of Apache Roller →
CVE-2026-86507
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted…
6.1
Medium
CVE-2026-82379
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest…
7.7
High
CVE-2026-82380
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform…
8.1
High
CVE-2026-82381
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
5.4
Medium