Resource exhaustion in Next.js - CVE-2021-43803
Published: June 19, 2023 / Updated: July 11, 2024
Vulnerability identifier: #VU77518
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-43803
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
Next.js
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Cloud Pak for Security (CP4S)
QRadar User Behavior Analytics
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Cloud Pak for Security (CP4S)
QRadar User Behavior Analytics
How to mitigate CVE-2021-43803
Install updates from vendor's website.
Next.js - addressed in versions 11.1.3, 12.0.5
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
Cloud Pak for Security (CP4S) - update to 1.10.10.0
QRadar User Behavior Analytics - update to 4.1.13
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
Cloud Pak for Security (CP4S) - update to 1.10.10.0
QRadar User Behavior Analytics - update to 4.1.13
External References
- https://github.com/vercel/next.js/releases/v12.0.5
- https://github.com/vercel/next.js/pull/32080
- https://github.com/vercel/next.js/releases/tag/v11.1.3
- https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264
- https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx