GROWI is affected by a high-severity denial of service vulnerability that allows unauthenticated attackers to crash the service through inefficient regular expression processing.

The application is vulnerable to a regular expression denial of service (ReDoS) flaw due to inefficient regular expression complexity. An unauthenticated attacker can exploit this by submitting a crafted input string that forces the application to consume excessive CPU resources.

Successful exploitation of this vulnerability results in a denial of service, rendering the GROWI platform unavailable to legitimate users. Given the CVSS 7.5 score, this represents a significant availability risk that can disrupt organizational workflows and hinder collaboration. Prolonged downtime may lead to operational delays and necessitate emergency incident response activities.

Immediate Action: Review the official vendor security advisory at the provided references to determine if a patch is available for your specific deployment. If no patch is currently available, restrict access to the vulnerable application components where possible.

Proactive Monitoring: Monitor server CPU utilization and error logs for spikes or patterns indicative of resource exhaustion attacks.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious or overly complex input strings before they reach the application backend.

Public Exploit Available: No

This vulnerability presents a clear risk to service availability due to the unauthenticated nature of the attack vector. Organizations utilizing GROWI should prioritize monitoring their infrastructure for signs of resource exhaustion and coordinate with the vendor to apply necessary security updates as soon as they are released.