Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-prhj-8562-p8gj

Опубликовано: 20 фев. 2024
Источник: github
Github: Не прошло ревью
CVSS3: 7.5

Описание

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

EPSS

Процентиль: 42%
0.00196
Низкий

7.5 High

CVSS3

Дефекты

CWE-404

Связанные уязвимости

CVSS3: 7.5
ubuntu
почти 2 года назад

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

CVSS3: 7.5
redhat
почти 2 года назад

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

CVSS3: 7.5
nvd
почти 2 года назад

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

CVSS3: 7.5
msrc
почти 2 года назад

Описание отсутствует

CVSS3: 7.5
debian
почти 2 года назад

A vulnerability in Node.js HTTP servers allows an attacker to send a s ...

EPSS

Процентиль: 42%
0.00196
Низкий

7.5 High

CVSS3

Дефекты

CWE-404