Uncaught Exception Affecting commons-validator:commons-validator package, versions [,1.3.1)

Affected versions of this package are vulnerable to Uncaught Exception in the isValidAuthority method of UrlValidator, which allocates new String[10] for the hostname labels and increments segmentCount once per dot separated label with no check against the array length. An attacker can terminate the request handling thread by submitting a URL whose hostname carries eleven or more labels, such as http://a.a.a.a.a.a.a.a.a.a.com/, so the assignment to domainSegment[10] throws and the exception propagates through isValid to the caller. This requires the application to pass input it does not control to UrlValidator.isValid or GenericValidator.isUrl without using a handler or catching unchecked exceptions, and the array is allocated only on the hostname branch, so an authority given as an IP literal never reaches it.

• GitHub Commit
• Vulnerability Advisory