Detections
Analytics

SCA: security update for com.typesafe.play:play_2.12, com.typesafe.play:play_2.13 (GHSA-v8x6-59g4-5g3w)

high Tenable Cloud Security Plugin ID 419209

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been
 discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This
 can occur when using either the `Form#bindFromRequest` method on a JSON request body or the `Form#bind`
 method directly on a JSON value. If the JSON data being bound to the form contains a deeply-nested JSON
 object or array, the form binding implementation may consume all available heap space and cause an
 `OutOfMemoryError`. If executing on the default dispatcher and `akka.jvm-exit-on-fatal-error` is
 enabled—as it is by default—then this can crash the application process. `Form.bindFromRequest` is
 vulnerable when using any body parser that produces a type of `AnyContent` or `JsValue` in Scala, or one
 that can produce a `JsonNode` in Java. This includes Play's default body parser. This vulnerability been
 patched in version 2.8.16. There is now a global limit on the depth of a JSON object that can be parsed,
 which can be configured by the user if necessary. As a workaround, applications that do not need to parse
 a request body of type `application/json` can switch from the default body parser to another body parser
 that supports only the specific type of body they expect. (CVE-2022-31018)

See Also

https://github.com/advisories/GHSA-v8x6-59g4-5g3w

Plugin Details

Severity: High

ID: 419209

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2022-31018

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/3/2022

Vulnerability Publication Date: 6/2/2022

Reference Information

CVE: CVE-2022-31018

cwe: CWE-400