CVE-2022-29158: Apache OFBiz

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599

Affected products

• Apache OFBiz: before 18.12.06 (fixed in 18.12.06)

Published 2022-09-02. Last modified 2026-06-17.