{"action":"Upgrade com.graphhopper:graphhopper-web-bundle to 3.2 or later.","affected":[{"fixed":"3.2","introduced":"0"}],"component":"com.graphhopper:graphhopper-web-bundle","cve_ids":["CVE-2021-23408"],"ecosystem":"Maven","epss":0.01401,"exploited":false,"fixed_versions":["3.2"],"ghsa_id":"GHSA-qhxh-9hhx-6p7v","id":"tcs_01M5N99MQWSMC6N7MW1FNTCTND","modified_at":"2026-07-08T06:49:31.391180521Z","published_at":"2021-08-02T16:59:35Z","references":["https://osv.dev/vulnerability/GHSA-qhxh-9hhx-6p7v","https://nvd.nist.gov/vuln/detail/CVE-2021-23408","https://github.com/graphhopper/graphhopper/pull/2370","https://github.com/graphhopper/graphhopper/releases/tag/3.1","https://github.com/graphhopper/graphhopper/releases/tag/3.2","https://snyk.io/vuln/SNYK-JAVA-COMGRAPHHOPPER-1320114"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-qhxh-9hhx-6p7v","url":"https://osv.dev/vulnerability/GHSA-qhxh-9hhx-6p7v"}],"summary":"Prototype Pollution in GraphHopper"}