wsproject ws CVE-2021-32640 in Wsproject and NetApp Products
Published on May 25, 2021

ReDoS in Sec-Websocket-Protocol header

product logo product logo
ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

Github Repository Vendor Advisory NVD

Vulnerability Analysis

CVE-2021-32640 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
LOW

Weakness Type

What is a Resource Exhaustion Vulnerability?

The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CVE-2021-32640 has been classified to as a Resource Exhaustion vulnerability or weakness.


Products Associated with CVE-2021-32640

stack.watch emails you whenever new vulnerabilities are published in Wsproject Ws or NetApp E Series Performance Analyzer. Just hit a watch button to start following.

Wsproject Ws
NetApp E Series Performance Analyzer

Affected Versions

websockets ws Version >= 5.0.0 <= 7.4.5 is affected by CVE-2021-32640

Vulnerable Packages

The following package name and versions may be associated with CVE-2021-32640

Package Manager Vulnerable Package Versions Fixed In
npm ws >= 5.0.0, < 7.4.5 7.4.5

Exploit Probability

EPSS
2.82%
Percentile
86.66%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.