Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

GHSA-7CMJ-V6X8-FRVV org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the compile function. An attacker can cause excessive memory consumption by supplying a large comma-separated selector list, leading to process termination or degraded system...

io.micronaut:micronaut-discovery-client (1.1.0.m2), io.micronaut:micronaut-function-client (1.1.0.m2) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.0.m2)

io.micronaut:micronaut-http-client MAVEN version 1.1.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.0.m2 - io.micronaut:micronaut-function-clien...

io.micronaut:micronaut-discovery-client (1.1.0), io.micronaut:micronaut-function-client (1.1.0) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.0)

io.micronaut:micronaut-http-client MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.0 - io.micronaut:micronaut-function-client 1.1....

io.micronaut:micronaut-discovery-client (1.1.0.rc2), io.micronaut:micronaut-function-client (1.1.0.rc2) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.0.rc2)

io.micronaut:micronaut-http-client MAVEN version 1.1.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.0.rc2 -...

io.micronaut:micronaut-discovery-client (1.1.2), io.micronaut:micronaut-function-client (1.1.2) +2 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.2)

io.micronaut:micronaut-http-client MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.2 - io.micronaut:micronaut-function-client 1.1....

io.micronaut:micronaut-discovery-client (1.1.1), io.micronaut:micronaut-function-client (1.1.1) +2 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.1)

io.micronaut:micronaut-http-client MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.1 - io.micronaut:micronaut-function-client 1.1....

io.micronaut:micronaut-discovery-client (1.2.0.rc2), io.micronaut:micronaut-function-client (1.2.0.rc2) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.2.0.rc2)

io.micronaut:micronaut-http-client MAVEN version 1.2.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.2.0.rc2 -...

io.micronaut:micronaut-discovery-client (1.1.3), io.micronaut:micronaut-function-client (1.1.3) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.3)

io.micronaut:micronaut-http-client MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.3 - io.micronaut:micronaut-function-client 1.1....

io.micronaut:micronaut-discovery-client (1.3.0.m2), io.micronaut:micronaut-function-client (1.3.0.m2) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.3.0.m2)

io.micronaut:micronaut-http-client MAVEN version 1.3.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.3.0.m2 - io.micronaut:micronaut-function-clien...

io.micronaut.configuration:micronaut-netflix-ribbon (1.1.0), io.micronaut.configuration:micronaut-security-oauth2 (>=1.3.0, <=1.3.1) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.3.0)

io.micronaut:micronaut-http-client MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.configuration:micronaut-netflix-ribbon 1.1.0 -...

io.micronaut.gcp:micronaut-gcp-http-client (2.0.0.m3), io.micronaut.gcp:micronaut-gcp-tracing (>=2.0.0.m1, <=2.0.0.m3) +4 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.3.4)

io.micronaut:micronaut-http-client MAVEN version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.gcp:micronaut-gcp-http-client 2.0.0.m3 - io.micronaut.gcp:micronaut-gcp-tracin...

io.micronaut:micronaut-discovery-client (1.3.6), io.micronaut:micronaut-function-client (1.3.6) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.3.6)

io.micronaut:micronaut-http-client MAVEN version 1.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.3.6 - io.micronaut:micronaut-function-client 1.3....

io.micronaut:micronaut-discovery-client (2.0.0.rc1), io.micronaut:micronaut-function-client (2.0.0.rc1) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.0.0.rc1)

io.micronaut:micronaut-http-client MAVEN version 2.0.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 2.0.0.rc1 -...

io.micronaut:micronaut-discovery-client (2.0.0.rc2), io.micronaut:micronaut-function-client (2.0.0.rc2) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.0.0.rc2)

io.micronaut:micronaut-http-client MAVEN version 2.0.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 2.0.0.rc2 -...

io.micronaut:micronaut-discovery-client (1.2.6), io.micronaut:micronaut-function-client (1.2.6) +2 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.2.6)

io.micronaut:micronaut-http-client MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.2.6 - io.micronaut:micronaut-function-client 1.2....