GCVE - cpe:2.3:a:apache:shenyu:2.4.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:shenyu:2.4.1:*:*:*:*:*:*:*

part: a version: 2.4.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Shenyu (`568c2d55-7142-5fa6-981e-8c337d6b9a17`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/shenyu`	purl2cpe	2026-06-01 10:14:25.154833
`pkg:github/apache/incubator-shenyu`	purl2cpe	2026-06-01 10:14:25.154834
`pkg:maven/org.apache.shenyu/shenyu`	purl2cpe	2026-06-01 10:14:25.154836

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-26650`	vulnerable	2026-06-08 05:41:52.745249	Apache ShenYu (incubating) Regular expression denial of service In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3. Published: 2022-05-17T08:05:10.000Z Updated: 2024-08-03T05:11:43.499Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/8rp33m3nm4bwtx3qx76mqynth3t3d673 http://www.openwall.com/lists/oss-security/2022/05/17/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-23945`	vulnerable	2026-06-08 05:40:59.369965	Apache ShenYu missing authentication allows gateway registration Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1. Published: 2022-01-25T13:00:25.000Z Updated: 2024-08-03T03:59:23.281Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s http://www.openwall.com/lists/oss-security/2022/01/25/6 http://www.openwall.com/lists/oss-security/2022/01/26/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-23944`	vulnerable	2026-06-08 05:40:59.369569	Apache ShenYu 2.4.1 Improper access control User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. Published: 2022-01-25T13:00:24.000Z Updated: 2024-08-03T03:59:23.263Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/dbrjnnlrf80dr0f92k5r2ysfvf1kr67y http://www.openwall.com/lists/oss-security/2022/01/25/5 http://www.openwall.com/lists/oss-security/2022/01/25/15 http://www.openwall.com/lists/oss-security/2022/01/26/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-23223`	vulnerable	2026-06-08 05:40:56.631417	Apache ShenYu Password leakage On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later. Published: 2022-01-25T13:00:22.000Z Updated: 2024-08-03T03:36:20.334Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s http://www.openwall.com/lists/oss-security/2022/01/25/7 http://www.openwall.com/lists/oss-security/2022/01/26/4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-45029`	vulnerable	2026-06-08 05:36:47.695505	Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1. Published: 2022-01-25T13:00:21.000Z Updated: 2024-08-04T04:32:13.478Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/3zzmwvg3012tg306x8o893fvdcssx639 http://www.openwall.com/lists/oss-security/2022/01/25/8 http://www.openwall.com/lists/oss-security/2022/01/26/1	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.