Resource exhaustion in ws - CVE-2021-32640

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in the "Sec-Websocket-Protocol" header. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Affected software

How to mitigate CVE-2021-32640

External References

• https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693
• https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff

Related Security Bulletins

• Denial of service in ws package for npm
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data