CVE-2020-27196: 
Java vulnerability analysis and mitigation

An issue was discovered in PlayJava in Play Framework versions 2.6.0 through 2.8.2, disclosed on November 6, 2020. The vulnerability affects the body parsing functionality of HTTP requests, where the system eagerly parses a payload based on the Content-Type header (NVD, Play Security).

The vulnerability occurs when the body parsing mechanism eagerly processes HTTP request payloads upon receiving a Content-Type header. When a deep JSON structure is sent to a valid POST endpoint, regardless of whether it expects JSON payloads or not, it can trigger a StackOverflowError. The vulnerability has been assigned a CVSS score of 7.0 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C) (Play Security).

The vulnerability only impacts Play applications implemented using the PlayJava flavor. When exploited, it can cause a Denial of Service condition through a StackOverflowError when processing specially crafted JSON payloads (Play Security).

The vulnerability can be exploited by sending a deep JSON structure to any valid POST endpoint, regardless of whether the endpoint expects JSON input. No authentication is required for exploitation, making it accessible to remote attackers (NVD).

The vulnerability has been fixed in Play Framework versions 2.8.3 and 2.7.6. For version 2.6.x, which has reached end-of-support, no fix will be released, and users are advised to upgrade to a supported version as soon as possible to address this security issue (Play Security).