{"action":"Upgrade com.graphhopper:graphhopper-nav to 2.4 or later.","affected":[{"fixed":"2.4","introduced":"0"}],"component":"com.graphhopper:graphhopper-nav","cve_ids":["CVE-2021-29506"],"ecosystem":"Maven","epss":0.01404,"exploited":false,"fixed_versions":["2.4"],"ghsa_id":"GHSA-hf44-3mx6-vhhw","id":"tcs_01M5N90D575B7CFNNKE951PBEH","modified_at":"2026-07-08T06:29:14.735965590Z","published_at":"2021-05-19T23:02:57Z","references":["https://osv.dev/vulnerability/GHSA-hf44-3mx6-vhhw","https://github.com/graphhopper/graphhopper/security/advisories/GHSA-hf44-3mx6-vhhw","https://nvd.nist.gov/vuln/detail/CVE-2021-29506","https://github.com/graphhopper/graphhopper/pull/2304","https://github.com/graphhopper/graphhopper/commit/eb189be1fa7443ebf4ae881e737a18f818c95f41"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-hf44-3mx6-vhhw","url":"https://osv.dev/vulnerability/GHSA-hf44-3mx6-vhhw"}],"summary":"Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service."}