CVE-2024-37890

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan NULL Pointer Dereference. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Rincian

Terbit di NVD

17 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 70,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
• https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
• https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
• https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
• https://github.com/websockets/ws/issues/2230
• https://github.com/websockets/ws/pull/2231
• https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
• https://nodejs.org/api/http.html#servermaxheaderscount