[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiqK1csD5dRfmEYH68dIZ1HutgFsKy7xO9NagaU84Gxk":3,"g5a-risk:CVE-2022-31018":119},{"success":4,"data":5,"meta":117},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":43,"epssPercentile":26,"epssTimeSeries":44,"severity":45,"affectedProducts":46,"affectedProductsCount":52,"references":53,"referencesCount":68,"weaknesses":69,"weaknessesCount":52,"isActivelyExploited":78,"cisaInfo":26,"otxData":26,"relatedBlogPosts":79,"seoMetadata":80,"configurations":105,"relatedVendorCves":115,"notableEvents":116},"CVE-2022-31018","What is CVE-2022-31018?","Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the `Form#bindFromRequest` method on a JSON request body or the `Form#bind` method directly on a JSON value. If the JSON data being bound to the form contains a deeply-nested JSON object or array, the form binding implementation may consume all available heap space and cause an `OutOfMemoryError`. If executing on the default dispatcher and `akka.jvm-exit-on-fatal-error` is enabled—as it is by default—then this can crash the application process. `Form.bindFromRequest` is vulnerable when using any body parser that produces a type of `AnyContent` or `JsValue` in Scala, or one that can produce a `JsonNode` in Java. This includes Play's default body parser. This vulnerability been patched in version 2.8.16. There is now a global limit on the depth of a JSON object that can be parsed, which can be configured by the user if necessary. As a workaround, applications that do not need to parse a request body of type `application\u002Fjson` can switch from the default body parser to another body parser that supports only the specific type of body they expect.","Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms l...","2022-06-02T17:15:07.617","2022-06-13T12:26:58.4",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":33,"CVSSMetricV40":26},[16,29],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":25,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,{"Source":30,"Type":31,"CVSSData":32,"ExploitabilityScore":27,"ImpactScore":28},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":25,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},[34],{"Source":17,"Type":18,"CVSSData":35,"BaseSeverity":40,"ExploitabilityScore":41,"ImpactScore":42,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":36,"VectorString":37,"AccessVector":21,"AccessComplexity":22,"Authentication":23,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":38,"BaseScore":39,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:N\u002FAC:L\u002FAu:N\u002FC:N\u002FI:N\u002FA:P","PARTIAL",5,"MEDIUM",10,2.9,0.01695,[43,43,43,43,43,43,43],"High",[47],{"vendor":48,"product":49,"version":50,"criteria":51,"vulnerable":4},"lightbend","play_framework","*","cpe:2.3:a:lightbend:play_framework:*:*:*:*:*:*:*:*",1,[54,60,64],{"url":55,"source":56,"tags":57},"https:\u002F\u002Fgithub.com\u002Fplayframework\u002Fplayframework\u002Fpull\u002F11301","GitHub",[58,59],"Patch","Third Party Advisory",{"url":61,"source":56,"tags":62},"https:\u002F\u002Fgithub.com\u002Fplayframework\u002Fplayframework\u002Freleases\u002Ftag\u002F2.8.16",[63,59],"Release Notes",{"url":65,"source":56,"tags":66},"https:\u002F\u002Fgithub.com\u002Fplayframework\u002Fplayframework\u002Fsecurity\u002Fadvisories\u002FGHSA-v8x6-59g4-5g3w",[67,59],"Mitigation",3,[70],{"id":71,"name":72,"description":73,"extendedDescription":74,"status":75,"abstraction":76,"structure":77},"CWE-400","Uncontrolled Resource Consumption","The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.","Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.\nThere are at least three distinct scenarios which can commonly lead to resource exhaustion:\nResource exhaustion problems are often result due to an incorrect implementation of the following situations:","Draft","Class","Simple",false,[],{"title":81,"metaDescription":82,"keywords":83,"canonicalUrl":84,"structuredData":85},"What is CVE-2022-31018? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2022-31018, a high severity cyber security vulnerability from 2022. Play Framework is a web framework for Java and Scala. A den...","CVE-2022-31018, CVE-2022-31018 vulnerability, CVE-2022-31018 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, lightbend security, play_framework vulnerability","\u002Fwhat-is\u002Fcve-2022-31018",{"@context":86,"@type":87,"headline":81,"description":82,"datePublished":10,"dateModified":11,"author":88,"publisher":92,"about":96,"mainEntityOfPage":100,"articleSection":103,"keywords":104},"https:\u002F\u002Fschema.org","TechArticle",{"@type":89,"name":90,"url":91},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":89,"name":90,"url":91,"logo":93},{"@type":94,"url":95},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":97,"name":6,"description":98,"additionalType":99},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":101,"@id":102},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2022-31018","Cybersecurity","CVE-2022-31018, CVE-2022-31018 vulnerability, CVE-2022-31018 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[106],{"Operator":26,"Negate":26,"Nodes":107},[108],{"Operator":109,"Negate":26,"CPEMatch":110},"OR",[111],{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":112,"VersionStartExcluding":26,"VersionStartIncluding":113,"VersionEndExcluding":26,"VersionEndIncluding":114},"4BBDB71E-9591-43F8-B82A-139C92ADDAA4","2.8.3","2.8.15",[],[],{"lastModified":11,"cacheTime":118,"version":36},1792361958067,{"score":120,"band":121,"action":122,"scoredAt":123},46,"Medium","Plan remediation","2026-10-16T06:54:41.029269+00:00"]