com.graphhopper vulnerabilities

Products

• com.graphhopper/graphhopper-nav 1
• com.graphhopper/graphhopper-web-bundle 1

Latest com.graphhopper CVEs

Newest publication first

1. CVE-2021-23408 Prototype Pollution

   Published 2021-07-21

   Medium·CVSS 4.3 EPSS 1.4%

   This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or proto payload.

2. CVE-2021-29506 Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.

   Published 2021-05-13

   Medium·CVSS 6.5 EPSS 1.4%

   GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix: https://git...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.