CVE-2022-31018 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in com.typesafe.play:play_2.13. A fix is available for com.typesafe.play:play_2.13 — see the affected versions and patch details below.
Denial of service binding form from JSON in Play Framework
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2022-31018.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
com.typesafe.play:play_2.13☕com.typesafe.play:play_2.12Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Impact
A denial-of-service vulnerability has been discovered in Play's forms library, in both the Scala and Java APIs. This can occur when using either the Form#bindFromRequest method on a JSON request body or the Form#bind method directly on a JSON value. If the JSON data being bound to the form contains a deeply-nested JSON object or array, the form binding implementation may consume all available heap space and cause an OutOfMemoryError. If executing on the default dispatcher and akka.jvm-exit-on-fatal-error is enabled—as it is by default—then this can crash the application process.
Form.bindFromRequest is vulnerable when using any body parser that produces a type of AnyContent or JsValue in Scala, or one that can produce a JsonNode in Java. This includes Play's default body parser.
Patches
This vulnerability been patched in version 2.8.16. There is now a global limit on the depth of a JSON object that can be parsed, which can be configured by the user if necessary.
Workarounds
Applications that do not need to parse a request body of type application/json can switch from the default body parser to another body parser that supports only the specific type of body they expect; for example, the formUrlEncoded body parser can be used if the Play action only needs to accept application/x-www-form-urlencoded.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | com.typesafe.play:play_2.13 | ≥ 2.8.3&&< 2.8.16 | 2.8.16com.typesafe.play:play_2.13:2.8.16 |
| ☕Maven | com.typesafe.play:play_2.12 | ≥ 2.8.3&&< 2.8.16 | 2.8.16com.typesafe.play:play_2.12:2.8.16 |
Affected Products
play frameworklightbendDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.typesafe.play:play_2.13, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update com.typesafe.play:play_2.13 to 2.8.16 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-31018 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Frequently Asked Questions
Is CVE-2022-31018 in your dependencies?
Find it across Maven, including transitive dependencies.