5.3
CVSSv3

CVE-2021-32640

CVSSv4: NA | CVSSv3: 5.3 | CVSSv2: 5 | VMScore: 630 | EPSS: 0.00329 | KEV: Not Included
Published: 25/05/2021 Updated: 21/11/2024

Vulnerability Summary

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

ws project ws

netapp e-series performance analyzer -

Vendor Advisories

ws is an open source WebSocket client and server library for Nodejs A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server The vulnerability has been fixed in ws@746 (githubcom/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff) In vulnerable versions of ws, the ...

Github Repositories

Descrição Esse repositório contém códigos que simulam a exploração da vulnerabilidade CVE-2021-32640 encontrada na biblioteca githubcom/websockets/ws Isso faz parte de um trabalho da disciplina MAC0352 - Redes de Computadores e Sistemas Distribuídos com o objetivo de estudar algumas vulnerabilidades em aplica&cce