Apache ShenYu (incubating) Regular expression denial of service

Vulnerability

In Apache ShenYu (incubating) versions 2.4.0, 2.4.1, and 2.4.2, the RegexPredicateJudge.java class in shenyu-bootstrap uses Pattern.matches(conditionData.getParamValue(), realData) where both parameters are user-controllable [1][3]. This enables an attacker to supply a malicious regular expression that triggers catastrophic backtracking, leading to resource exhaustion [1][3].

Exploitation

An attacker must be able to send HTTP requests to the ShenYu gateway and control either the condition parameter (conditionData.getParamValue()) or the evaluation data (realData). The attacker provides a crafted regex string (e.g., with nested quantifiers or multiple overlapping patterns) and optionally a matching input string that forces the regex engine into exponential backtracking, consuming CPU and memory [1][3].

Impact

Successful exploitation causes a denial-of-service (DoS) condition through high CPU consumption and possible memory exhaustion, making the ShenYu gateway unresponsive to legitimate traffic. No data disclosure or privilege escalation is reported [1][3].

Mitigation

The vulnerability is fixed in Apache ShenYu (incubating) 2.4.3 [1][3]. Users should upgrade to 2.4.3 or apply the patch at https://github.com/apache/incubator-shenyu/pull/2975 [3]. No known workarounds exist for unpatched versions.