PT-2024-5560 · Npm+4 · Ws+4
Ryan Lapointe
·
Published
2024-06-10
·
Updated
2026-01-06
·
CVE-2024-37890
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
ws versions prior to 8.17.1
ws versions prior to 7.5.10
ws versions prior to 6.2.3
ws versions prior to 5.2.4
Description
The issue is related to errors in handling request headers in the ws library for Node.js, specifically when the number of headers exceeds the
server.maxHeadersCount threshold. This can be exploited by a remote attacker to cause a denial of service. The vulnerability can be mitigated by reducing the maximum allowed length of request headers or setting server.maxHeadersCount to 0.Recommendations
For ws versions prior to 8.17.1, update to version 8.17.1 or later.
For ws versions prior to 7.5.10, update to version 7.5.10 or later.
For ws versions prior to 6.2.3, update to version 6.2.3 or later.
For ws versions prior to 5.2.4, update to version 5.2.4 or later.
As a temporary workaround, consider reducing the maximum allowed length of request headers using the
--max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent.
Alternatively, set server.maxHeadersCount to 0 so that no limit is applied.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Confluence
Debian
Red Os
Ws