Published: 07/12/2021 Updated: 03/09/2022

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

ModSecurity 3.x up to and including 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 up to and including 2.9.4.

Vulnerable Product	Search on Vulmon	Subscribe to Product
trustwave modsecurity
f5 nginx modsecurity waf r25
f5 nginx modsecurity waf r24
debian debian linux 9.0
debian debian linux 10.0
debian debian linux 11.0
oracle http server 12.2.1.3.0
oracle http server 12.2.1.4.0
oracle zfs storage appliance kit 8.8

It was discovered that modsecurity-apache, an Apache module to tighten the Web application security, does not properly handles excessively nested JSON objects, which could result in denial of service The update introduces a new SecRequestBodyJsonDepthLimit option to limit the maximum request body JSON parsing depth which ModSecurity will accept (d ...

Detection and Mitigation script for CVE-2021-42717 -> ModSecurity DoS Vulnerability in JSON Parsing

Detection-and-Mitigation-script-for-CVE-2021-42717 Detection and Mitigation script for CVE-2021-42717 -> ModSecurity DoS Vulnerability in JSON Parsing ModSecurity 3x through 305 mishandles excessively nested JSON objects Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests Even a moderate

CWE-674 https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-dos-vulnerability-in-json-parsing-cve-2021-42717/https://www.debian.org/security/2021/dsa-5023 https://www.oracle.com/security-alerts/cpuapr2022.html https://lists.debian.org/debian-lts-announce/2022/05/msg00042.html https://nvd.nist.gov https://www.debian.org/security/2021/dsa-5023 https://github.com/EkamSinghWalia/Detection-and-Mitigation-script-for-CVE-2021-42717

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-42717

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect