Play Framework Security

Contact owners and managers

1–22 of 22

Security alerts concerning Play framework will be posted here.

Don't report any security issue publicly here!

What if you find any security problem with Play framework?

All security bugs in Play should be reported by email to
security@playframework.com

We strongly encourage folks to report such problems to our private

security mailing list first, before disclosing them in a public forum.

This list is delivered to a subset of the core team who handle security issues.

You can also see a summary of security vulnerabilities at

https://playframework.com/security/vulnerability

0 selected

Matthias Kurz

11/7/23

Play Framework 2.9 and 3.0 released / Play 2.8 EOL dates

The Play Team is thrilled to announce the release of Play 2.9.0 and 3.0.0! These releases represent a

unread,

Play Framework 2.9 and 3.0 released / Play 2.8 EOL dates

The Play Team is thrilled to announce the release of Play 2.9.0 and 3.0.0! These releases represent a

11/7/23

Matthias Kurz

6/8/22

CVE-2022-31018 and CVE-2022-31023

Hi, two vulnerabilities have been found in Play Framework: CVE-2022-31018 - Denial of service when

unread,

CVE-2022-31018 and CVE-2022-31023

Hi, two vulnerabilities have been found in Play Framework: CVE-2022-31018 - Denial of service when

6/8/22

Ignasi Marimon-Clos i Sunyol

11/23/20

CVE-2020-28923 - Improper removal of sensitive information before storage or transfer

Play JSON handling on the Java API serializes private and protected fields. This vulnerability

unread,

CVE-2020-28923 - Improper removal of sensitive information before storage or transfer

Play JSON handling on the Java API serializes private and protected fields. This vulnerability

11/23/20

Ignasi Marimon-Clos i Sunyol

11/23/20

CVE-2020-27196 - DoS via JSON Stack Overflow

Play body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON

unread,

CVE-2020-27196 - DoS via JSON Stack Overflow

Play body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON

11/23/20

Ignasi Marimon-Clos i Sunyol

11/23/20

CVE-2020-26883 - JSON parse Uncontrolled Recursion

A vulnerability has been found in the handling of JSON parser. Carefully crafted JSON payloads sent

unread,

CVE-2020-26883 - JSON parse Uncontrolled Recursion

A vulnerability has been found in the handling of JSON parser. Carefully crafted JSON payloads sent

11/23/20

Ignasi Marimon-Clos i Sunyol

11/23/20

CVE-2020-26882 - JSON parse Data Amplification Inbox

A vulnerability has been found in the handling of JSON parser. Carefully crafted JSON payloads sent

unread,

CVE-2020-26882 - JSON parse Data Amplification Inbox

A vulnerability has been found in the handling of JSON parser. Carefully crafted JSON payloads sent

11/23/20

James Roper

8/16/20

CVE-2020-12480 - CSRF Content-Type black list bypass

A vulnerability has been found in Play Framework's CSRF filter. If being used with a Content-Type

unread,

CVE-2020-12480 - CSRF Content-Type black list bypass

A vulnerability has been found in Play Framework's CSRF filter. If being used with a Content-Type

8/16/20

James Roper

7/16/18

CVE-2018-13864 - Path traversal vulnerability in Play assets controller

A path travernsal vulnerability has been found in the Play Assets controller when running on Windows.

unread,

CVE-2018-13864 - Path traversal vulnerability in Play assets controller

A path travernsal vulnerability has been found in the Play Assets controller when running on Windows.

7/16/18

Greg Methvin

10/6/17

Improper Vary header handling in CORS filter

Improper Vary header handling in CORS filter Date 5 Oct 2017 Description Play's CORS filter will

unread,

Improper Vary header handling in CORS filter

Improper Vary header handling in CORS filter Date 5 Oct 2017 Description Play's CORS filter will

10/6/17

Greg Methvin

9/20/17

URI parsing vulnerability in AsyncHttpClient

Description A low-severity vulnerability has been found in the URI parsing of AsyncHttpClient, which

unread,

URI parsing vulnerability in AsyncHttpClient

Description A low-severity vulnerability has been found in the URI parsing of AsyncHttpClient, which

9/20/17

Will Sargent

4/9/17

Announcement

Java Deserialization vulnerability in Logback SocketAppender

Date April 7th 2017 Description A deserialization vulnerability has been found in the socket appender

unread,

Announcement

Java Deserialization vulnerability in Logback SocketAppender

Date April 7th 2017 Description A deserialization vulnerability has been found in the socket appender

4/9/17

Will Sargent

1/26/17

Play Framework DoS Vulnerability in WS with OAuth 1.0 over TLS

A denial of service (DoS) vulnerability has been found in the WS HTTP Client in Play when using the

unread,

Play Framework DoS Vulnerability in WS with OAuth 1.0 over TLS

A denial of service (DoS) vulnerability has been found in the WS HTTP Client in Play when using the

1/26/17

James Roper

3/4/16

Play Framework CSRF Bypass

A vulnerability has been found in Play's CSRF support when the victim is using recent versions of

unread,

Play Framework CSRF Bypass

A vulnerability has been found in Play's CSRF support when the victim is using recent versions of

3/4/16

James Roper

1/7/16

Play Framework 1 Session Hijack Vulnerability

A security vulnerability has been found in Play Framework versions 1.0 through 1.4.0, excluding 1.2.7

unread,

Play Framework 1 Session Hijack Vulnerability

A security vulnerability has been found in Play Framework versions 1.0 through 1.4.0, excluding 1.2.7

1/7/16

James Roper

5/8/15

Play Framework Http Only Cookie Bypass Vulnerability

A security vulnerability has been found in all versions of Play Framework up to and including 2.3.8.

unread,

Play Framework Http Only Cookie Bypass Vulnerability

A security vulnerability has been found in all versions of Play Framework up to and including 2.3.8.

5/8/15

James Roper

5/6/15

Play Framework 1 XSS Vulnerability

A security vulnerability has been found in Play Framework versions 1.2.0 to 1.3.0. It affects any

unread,

Play Framework 1 XSS Vulnerability

A security vulnerability has been found in Play Framework versions 1.2.0 to 1.3.0. It affects any

5/6/15

James Roper

10/7/14

Play Framework Java XML External Entity Vulnerability

A security vulnerability has been found in all versions of Play Framework up to and including 2.3.4.

unread,

Play Framework Java XML External Entity Vulnerability

A security vulnerability has been found in all versions of Play Framework up to and including 2.3.4.

10/7/14

James Roper

4/30/14

Play WebSockets security vulnerability

Hi All, A security vulnerability has been found in a library that Play Framework depends on. The

unread,

Play WebSockets security vulnerability

Hi All, A security vulnerability has been found in a library that Play Framework depends on. The

4/30/14

James Roper

9/19/13

Play Framework XML External Entity

A security vulnerability has been found in all stable versions of Play Framework 2.x released before

unread,

Play Framework XML External Entity

A security vulnerability has been found in all stable versions of Play Framework 2.x released before

9/19/13

James Roper

9/11/13

Play Framework XML External Entity Vulnerability

A security vulnerability has been found in all stable versions of Play Framework 2.x released before

unread,

Play Framework XML External Entity Vulnerability

A security vulnerability has been found in all stable versions of Play Framework 2.x released before

9/11/13

James Roper

8/6/13

Play Framework Session Injection Security Vulnerability

A security vulnerability has been found in all stable versions of Play Framework released before

unread,

Play Framework Session Injection Security Vulnerability

A security vulnerability has been found in all stable versions of Play Framework released before

8/6/13

Guillaume Bort

8/25/11

Security alerts for Play framework

Security alerts concerning Play framework will be posted here. Don't report any security issue

unread,locked,

Security alerts for Play framework

Security alerts concerning Play framework will be posted here. Don't report any security issue

8/25/11