Apereo CAS Regular Expression Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Apereo CAS version 5.2.6. The issue arises in the 'CasConfigurationMetadataServerController.java' file, where the 'name' argument is manipulated, leading to inefficient regular expression processing. This vulnerability allows for excessive CPU usage, causing availability issues. The problem can be exploited remotely, and a proof-of-concept exploit is publicly available.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing excessive CPU consumption and availability degradation.