CVE-2024-37890 (GCVE-0-2024-37890)
Vulnerability from cvelistv5
Published
2024-06-17 19:09
Modified
2024-08-02 03:57
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-476 - NULL Pointer Dereference
Summary
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
References
security-advisories@github.com https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
security-advisories@github.com https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
security-advisories@github.com https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
security-advisories@github.com https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
security-advisories@github.com https://github.com/websockets/ws/issues/2230
security-advisories@github.com https://github.com/websockets/ws/pull/2231
security-advisories@github.com https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
security-advisories@github.com https://nodejs.org/api/http.html#servermaxheaderscount
af854a3a-2127-422b-91ae-364da2661108 https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
af854a3a-2127-422b-91ae-364da2661108 https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
af854a3a-2127-422b-91ae-364da2661108 https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
af854a3a-2127-422b-91ae-364da2661108 https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
af854a3a-2127-422b-91ae-364da2661108 https://github.com/websockets/ws/issues/2230
af854a3a-2127-422b-91ae-364da2661108 https://github.com/websockets/ws/pull/2231
af854a3a-2127-422b-91ae-364da2661108 https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
af854a3a-2127-422b-91ae-364da2661108 https://nodejs.org/api/http.html#servermaxheaderscount
Impacted products
Vendor Product Version
websockets ws Version: >= 2.1.0, < 5.2.4
Version: >= 6.0.0, < 6.2.3
Version: >= 7.0.0, < 7.5.10
Version: >= 8.0.0, < 8.17.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ws",
            "vendor": "websockets",
            "versions": [
              {
                "status": "affected",
                "version": "2.1.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ws",
            "vendor": "websockets",
            "versions": [
              {
                "lessThan": "5.2.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ws",
            "vendor": "websockets",
            "versions": [
              {
                "status": "affected",
                "version": "6.0.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ws",
            "vendor": "websockets",
            "versions": [
              {
                "lessThan": "6.2.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ws",
            "vendor": "websockets",
            "versions": [
              {
                "status": "affected",
                "version": "7.0.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ws",
            "vendor": "websockets",
            "versions": [
              {
                "lessThan": "7.5.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ws",
            "vendor": "websockets",
            "versions": [
              {
                "status": "affected",
                "version": "8.0.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ws",
            "vendor": "websockets",
            "versions": [
              {
                "lessThan": "8.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37890",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-18T13:25:45.808140Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T13:44:06.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:57:40.022Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q"
          },
          {
            "name": "https://github.com/websockets/ws/issues/2230",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/websockets/ws/issues/2230"
          },
          {
            "name": "https://github.com/websockets/ws/pull/2231",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/websockets/ws/pull/2231"
          },
          {
            "name": "https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f"
          },
          {
            "name": "https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e"
          },
          {
            "name": "https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c"
          },
          {
            "name": "https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63"
          },
          {
            "name": "https://nodejs.org/api/http.html#servermaxheaderscount",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://nodejs.org/api/http.html#servermaxheaderscount"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ws",
          "vendor": "websockets",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 5.2.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.5.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.17.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-17T19:09:02.127Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q"
        },
        {
          "name": "https://github.com/websockets/ws/issues/2230",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/issues/2230"
        },
        {
          "name": "https://github.com/websockets/ws/pull/2231",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/pull/2231"
        },
        {
          "name": "https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f"
        },
        {
          "name": "https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e"
        },
        {
          "name": "https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c"
        },
        {
          "name": "https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63"
        },
        {
          "name": "https://nodejs.org/api/http.html#servermaxheaderscount",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://nodejs.org/api/http.html#servermaxheaderscount"
        }
      ],
      "source": {
        "advisory": "GHSA-3h5v-q93c-6h6q",
        "discovery": "UNKNOWN"
      },
      "title": "Denial of service when handling a request with many HTTP headers in ws"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-37890",
    "datePublished": "2024-06-17T19:09:02.127Z",
    "dateReserved": "2024-06-10T19:54:41.360Z",
    "dateUpdated": "2024-08-02T03:57:40.022Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-37890\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-06-17T20:15:13.203\",\"lastModified\":\"2024-11-21T09:24:28.810\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.\"},{\"lang\":\"es\",\"value\":\"ws es un cliente y servidor WebSocket de c\u00f3digo abierto para Node.js. Una solicitud con una cantidad de encabezados que exceda el umbral server.maxHeadersCount podr\u00eda usarse para bloquear un servidor ws. La vulnerabilidad se solucion\u00f3 en ws@8.17.1 (e55e510) y se actualiz\u00f3 a ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3) y ws@5.2.4 (4abd8f6). En versiones vulnerables de ws, el problema se puede mitigar de las siguientes maneras: 1. Reduzca la longitud m\u00e1xima permitida de los encabezados de solicitud usando las opciones --max-http-header-size=size y/o maxHeaderSize para que no haya m\u00e1s Se pueden enviar encabezados superiores al l\u00edmite server.maxHeadersCount. 2. Establezca server.maxHeadersCount en 0 para que no se aplique ning\u00fan l\u00edmite.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"references\":[{\"url\":\"https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/websockets/ws/issues/2230\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/websockets/ws/pull/2231\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://nodejs.org/api/http.html#servermaxheaderscount\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/websockets/ws/issues/2230\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/websockets/ws/pull/2231\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://nodejs.org/api/http.html#servermaxheaderscount\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-37890\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-18T13:25:45.808140Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*\"], \"vendor\": \"websockets\", \"product\": \"ws\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.1.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*\"], \"vendor\": \"websockets\", \"product\": \"ws\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.2.4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*\"], \"vendor\": \"websockets\", \"product\": \"ws\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*\"], \"vendor\": \"websockets\", \"product\": \"ws\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"6.2.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*\"], \"vendor\": \"websockets\", \"product\": \"ws\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*\"], \"vendor\": \"websockets\", \"product\": \"ws\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"7.5.10\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*\"], \"vendor\": \"websockets\", \"product\": \"ws\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.0.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:*\"], \"vendor\": \"websockets\", \"product\": \"ws\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.17.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-18T13:31:19.779Z\"}}], \"cna\": {\"title\": \"Denial of service when handling a request with many HTTP headers in ws\", \"source\": {\"advisory\": \"GHSA-3h5v-q93c-6h6q\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"websockets\", \"product\": \"ws\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.1.0, \u003c 5.2.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.0.0, \u003c 6.2.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 7.0.0, \u003c 7.5.10\"}, {\"status\": \"affected\", \"version\": \"\u003e= 8.0.0, \u003c 8.17.1\"}]}], \"references\": [{\"url\": \"https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q\", \"name\": \"https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/websockets/ws/issues/2230\", \"name\": \"https://github.com/websockets/ws/issues/2230\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/websockets/ws/pull/2231\", \"name\": \"https://github.com/websockets/ws/pull/2231\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f\", \"name\": \"https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e\", \"name\": \"https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c\", \"name\": \"https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63\", \"name\": \"https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://nodejs.org/api/http.html#servermaxheaderscount\", \"name\": \"https://nodejs.org/api/http.html#servermaxheaderscount\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476: NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-06-17T19:09:02.127Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-37890\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-06-18T13:44:06.402Z\", \"dateReserved\": \"2024-06-10T19:54:41.360Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-06-17T19:09:02.127Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.