CVE-2020-27196: High severity play framework vulnerability
An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint (that may or may not expect JSON payloads) causes a StackOverflowError and Denial of Service.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-27196?
CVE-2020-27196 is a vulnerability in PlayJava in Play Framework 2.6.0 through 2.8.2 that allows for a Denial of Service (DoS) attack via a JSON stack overflow.
How severe is CVE-2020-27196?
CVE-2020-27196 has a severity rating of 7.5 (High).
What is the affected software for CVE-2020-27196?
The affected software for CVE-2020-27196 is Lightbend Play Framework versions 2.6.0 through 2.8.2.
How can I fix CVE-2020-27196?
To fix CVE-2020-27196, it is recommended to upgrade to a version of Lightbend Play Framework that is not affected by the vulnerability.
Where can I find more information about CVE-2020-27196?
You can find more information about CVE-2020-27196 on the official Play Framework website.