CVE-2021-32640

 

Published at: - 25-05-2021 09:15

Last modified: - 04-06-2022 04:13

Total changes: - 5

Description

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

 

Verification logic

 

Reference

• https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693
• https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff
• [tinkerpop-commits] 20210701 [tinkerpop] 01/03: Bumped ws to 6.2.2 to address CVE-2021-32640 CTR-Mailing List, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210706-0005/

 

Keywords

NVD

 

CVE-2021-32640

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures