CVE Feed

    Dashboard / CVE / CVE-2021-32640

    CVE-2021-32640

    ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

    Published:May 25, 2021
    Last Modified:Nov 21, 2024
    EPS:May 25, 2021
    EPSS Score:0.00466
    CVSS Score:5.3

    Affected Products

    Vendor
    Netapp
    Product
    E-series Performance Analyzer
    Vendor
    Ws Project
    Product
    Ws

    Exploits

    https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693

    Related CVEs

    CVE-2022-23491 (CVSS 6.8) — Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates wh…
    CVE-2022-45061 (CVSS 7.5) — An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when pr…
    CVE-2022-31123 (CVSS 6.1) — Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 ar…
    CVE-2022-31107 (CVSS 7.1) — Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.1…
    CVE-2022-31097 (CVSS 7.3) — Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior …
    CVE-2022-21702 (CVSS 6.5) — Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could se…
    CVE-2022-21703 (CVSS 6.3) — Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross …
    CVE-2022-21713 (CVSS 4.3) — Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multi…
    CVE-2021-3999 (CVSS 7.8) — A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corrupti…
    CVE-2021-4044 (CVSS 7.5) — Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High