Vulnerability · Published May 25, 2021 · Assigned by GitHub_M

CVE-2021-32640ReDoS in Sec-Websocket-Protocol header

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in ws from websockets. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)2.8%top 13.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-ws	7.4.2+~cs18.0.8-2	DEBIAN-CVE-2021-32640
Debian:13	node-ws	7.4.2+~cs18.0.8-2	DEBIAN-CVE-2021-32640
Debian:14	node-ws	7.4.2+~cs18.0.8-2	DEBIAN-CVE-2021-32640
Ubuntu:22.04:LTS	node-ws	no fix listed	UBUNTU-CVE-2021-32640
npm	ws	6.2.2	GHSA-6fc8-4gx4-v693
npm	ws	5.2.3	GHSA-6fc8-4gx4-v693
npm	ws	7.4.6	GHSA-6fc8-4gx4-v693

Affected products (as reported)

Vendor	Product	Versions
websockets	ws	>= 5.0.0 <= 7.4.5

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693 x_refsource_CONFIRM
https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff x_refsource_MISC
[tinkerpop-commits] 20210701 [tinkerpop] 01/03: Bumped ws to 6.2.2 to address CVE-2021-32640 CTR mailing-list, x_refsource_MLIST
https://security.netapp.com/advisory/ntap-20210706-0005/ x_refsource_CONFIRM