CVE-2020-28923

Summary: CVE-2020-28923 affects Play Framework 2.8.0–2.8.4 via Data Amplification when carefully crafted JSON payloads are sent as a form field, impacting users migrating from Play Java API-based JSON serialization of classes with protected/private fields. The vulnerability description and relate...

Play Framework Security Vulnerability

Lightbend Play Framework is a web application framework written in the Scala language from Lightbend, Inc. A security vulnerability exists in Play Framework versions 2.8.0 through 2.8.4, which stems from a carefully crafted JSON payload sent as a form field that causes data amplification. This...

Lightbend Play Framework Input Validation Error Vulnerability

Lightbend Play Framework is the United States Lightbend company a use of Scala language written in the Web application framework. A security vulnerability exists in Play Framework versions 2.6.0 through 2.8.2, which originates when an application accepts multi-part form-data JSON inputs and the...

Lightbend Play Framework Stack Depletion Vulnerability

Lightbend Play Framework is the United States Lightbend company a Java code library for building Web applications . A stack consumption vulnerability exists in Play Framework versions 2.6.0 through 2.8.2. The vulnerability can be exploited to cause infinite recursion via a specially crafted JSON...

Lightbend Play Framework Denial of Service Vulnerability

Lightbend Play Framework is the United States Lightbend company a use of Scala language written in the Web application framework. A denial of service vulnerability exists in PlayJava in Play Framework versions 2.6.0 through 2.8.2. The vulnerability can be exploited by an attacker to cause a...

CVE-2020-26882

In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input...

CVE-2020-26883

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents...

CVE-2020-27196

An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint that may or may not expect JSON payloads causes a StackOverflowError and Denial of...

CVE-2020-27196

An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint that may or may not expect JSON payloads causes a StackOverflowError and Denial of...

CVE-2020-26883

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents...

CVE-2020-26882

In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input...

CVE-2020-27196

An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint that may or may not expect JSON payloads causes a StackOverflowError and Denial of...

Design/Logic Flaw

An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint that may or may not expect JSON payloads causes a StackOverflowError and Denial of...

Input validation

In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input...

Design/Logic Flaw

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents...

CVE-2020-26882

CVE-2020-26882 (Play Framework): Affects Play Framework versions 2.6.0 through 2.8.2. The vulnerability arises when an application accepts multipart/form-data JSON input, causing data amplification. Documents explicitly describe this as a vulnerability in Play Framework, with potential impact on ...

CVE-2020-26882

In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input...

CVE-2020-27196

An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint that may or may not expect JSON payloads causes a StackOverflowError and Denial of...

CVE-2020-27196

CVE-2020-27196 affects Play Framework’s PlayJava in versions 2.6.0–2.8.2. The vulnerability arises from body parsing of HTTP requests that eagerly parses a payload when a Content-Type header is present; sending a deep JSON structure to a valid POST endpoint can trigger a StackOverflowError, resul...

CVE-2020-26883

Play Framework versions 2.6.0–2.8.2 contain a vulnerability caused by unbounded recursion during JSON parsing (notably in fromJson in form.scala per Veracode). This can lead to stack depletion/DoS via crafted JSON sent over the network. Affected components: Play Framework JSON parsing pathway; ro...