PT-2020-16529 · Lightbend · Play Framework

Lucash-Dev · Published 2020-11-06 · Updated 2022-02-10 · CVE-2020-26883

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Play Framework versions 2.6.0 through 2.8.2

Description The issue is caused by unbounded recursion during parsing of crafted JSON documents, leading to stack consumption.

Recommendations For Play Framework versions 2.6.0 through 2.8.2, update to a version that contains a fix for this issue to prevent stack consumption due to unbounded recursion during JSON parsing.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2020-26883

GHSA-P8P6-RCP6-4MRM

Affected Products

Play Framework

References · 9

• https://osv.dev/vulnerability/CVE-2020-26883 · Vendor Advisory
• https://playframework.com/security/vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26883 · Security Note
• https://playframework.com/security/vulnerability/CVE-2020-26883-JsonParseUncontrolledRecursion · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p8p6-rcp6-4mrm · Vendor Advisory
• https://github.com/playframework/playframework/pull/10495 · Note
• https://t.me/cvenotify/5253 · Telegram Post
• https://t.me/cvenotify/5243 · Telegram Post
• https://t.me/cibsecurity/15975 · Telegram Post