Asymmetric Resource Consumption (Amplification) in body-parser - CVE-2024-45590

Vulnerability identifier: #VU97208

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-45590

CWE-ID: CWE-405

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of a large number of requests when url encoding is enabled. A remote attacker can send multiple requests to the server and perform a denial of service (DoS) attack.

body-parser
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Watson Query on Cloud Pak for Data
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Maximo Application Suite Ai Service
Business Automation Insights
Security QRadar EDR
Cognos Dashboards on Cloud Pak for Data
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
QRadar Log Source Management App
Db2 Big SQL
Robotic Process Automation for Cloud Pak
IBM Cloud Pak for Security
IBM Cloud Transformation Advisor
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
Splunk User Behavior Analytics (UBA)
IBM Maximo Application Suite - Manage Component
IBM Spectrum Protect Plus
IBM Process Mining
Qradar Advisor
Unified OSS Console Assurance Monitoring (UOCAM)
Use Case Manager App
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Discovery for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Decision Optimization for Cloud Pak for Data
IBM Spectrum Control
IBM Maximo Application Suite
Bitbucket Data Center
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Observability with Instana
QRadar Suite
IBM Security QRadar Analyst Workflow
IBM Cloud Pak System
IBM Edge Application Manager
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
IBM DataPower Gateway
Cloud Pak for Data
Event Streams
IBM QRadar Data Synchronization App
Fedora
Network Observability plugin for the Openshift Console
Red Hat OpenShift GitOps
QRadar Pulse App
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
Bitbucket Server
IBM API Connect
IBM InfoSphere Information Server
IBM App Connect Enterprise
chromium

Install updates from vendor's website.

body-parser - update to 1.20.3
Data Virtualization (DV) on Cloud Pak for Data (CPD) - addressed in versions 2.2.8, 3.1.0
QRadar Suite - update to 1.10.27.0
Watson Query on Cloud Pak for Data - update to 2.2.8
IBM Cloud Transformation Advisor - update to 3.10.2
IBM Fusion HCI - update to 2.10.0
IBM Cloud Pak System - update to 2.3.6.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
Splunk User Behavior Analytics (UBA) - update to 5.4.2
Cloud Pak for Data - update to 5.2
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.27, 8.7.21, 9.0.14
Maximo Application Suite - IoT Component - addressed in versions 8.7.28, 8.8.24, 9.0.14, 9.1.5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.15, 8.11.13, 9.0.5
Maximo Application Suite Ai Service - update to 9.1.11
IBM Spectrum Protect Plus - update to 10.1.17.1
Event Streams - update to 11.5.1
Business Automation Insights - update to 24.0.0.0.2
Network Observability plugin for the Openshift Console - update to 1.7.0
Migration Toolkit for Containers - update to 1.8.5
Red Hat OpenShift GitOps - addressed in versions 1.12.6, 1.13.2
IBM Process Mining - update to 2.0.0 IF001
QRadar Pulse App - update to 2.2.15
OpenShift Service Mesh - addressed in versions 2.5.5, 2.6.2
Qradar Advisor - update to 2.6.6
IBM Security QRadar Analyst Workflow - update to 2.34.0
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.10
IBM QRadar Data Synchronization App - update to 3.2.1
Security QRadar EDR - update to 3.12.13
Use Case Manager App - update to 4.0.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4, 4.14.18, 4.15.14, 4.16.3, 4.17.0, 4.17.7
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.4.6, 4.5.5
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.7, 5.1.0
Red Hat OpenShift Container Platform - update to 4.17.15
App Connect Enterprise Certified Container - addressed in versions 5.0.22, 12.0.5, 12.4.0
IBM Decision Optimization for Cloud Pak for Data - update to 5.1
Cognos Dashboards on Cloud Pak for Data - update to 5.1.1
watsonx Assistant Cartridge - update to 5.1.3
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
IBM Spectrum Control - update to 5.4.13
QRadar Log Source Management App - update to 7.0.11
Db2 Big SQL - update to 7.8
IBM Maximo Application Suite - addressed in versions 8.10.19, 8.11.16, 9.0.4
Bitbucket Data Center - update to 8.19.25
Bitbucket Server - update to 8.19.25
IBM API Connect - update to 10.0.9.0
IBM DataPower Gateway - addressed in versions 10.5.0.14, 10.6.0.2
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
IBM App Connect Enterprise - update to 12.0.12.6
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
IBM Robotic Process Automation - update to 23.0.19
Robotic Process Automation for Cloud Pak - update to 23.0.19
chromium - addressed in versions 128.0.6613.137-1.el8, 128.0.6613.137-1.el9, 128.0.6613.137-1.fc39, 128.0.6613.137-1.fc40, 128.0.6613.137-1.fc41
IBM Observability with Instana - update to 285

• Exploit #11923 - CVE-2024-45590 (Exploit for CVE-2024-45590) (September 5, 2025)

• https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7
• https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce

• Remote denial of service in Express.js body-parser
• Fedora 39 update for chromium
• Fedora EPEL 8 update for chromium
• Fedora 41 update for chromium
• Fedora EPEL 9 update for chromium
• Fedora 40 update for chromium
• IBM App Connect Enterprise update for node.js expressjs body-parser module
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.6
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.16
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.7
• IBM Watson Discovery update for expressjs body-parser
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• IBM InfoSphere Information Server update for expressjs body-parser
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• IBM DataPower Gateway update for expressjs body-parser
• Multiple vulnerabilities in HPE Unified OSS Console Assurance Monitoring
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in QRadar Suite Software
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM QRadar Pulse App
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.5
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Observability with Instana
• IBM Robotic Process Automation for Cloud Pak update for expressjs body-parser
• Multiple vulnerabilities in IBM Use Case Manager App
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in IBM API Connect
• IBM Big SQL on IBM Cloud Pak for Data update for expressjs body-parser
• IBM Maximo Application Suite update for expressjs body-parser
• Multiple vulnerabilities in IBM Security QRadar Analyst Workflow
• IBM Spectrum Control update for expressjs body-parser
• Multiple vulnerabilities in IBM QRadar Log Source Management App
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• IBM Maximo Application Suite - Monitor Component update for expressjs body-parser
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in QRadar Advisor With Watson for IBM QRadar SIEM
• Multiple vulnerabilities in IBM Data Virtualization on Cloud Pak for Data
• IBM Decision Optimization for Cloud Pak for Data update for expressjs body-parser
• Splunk User Behavior Analytics (UBA) update for third-party components
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for expressjs body-parser
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage)
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.15
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.14
• IBM Cloud Pak for Data update for body-parser
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• IBM Maximo Application Suite - Manage Component update for body-parser
• Multiple vulnerabilities in IBM Cloud Pak System
• Bitbucket Data Center and Server update for body-parser
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Maximo AI Service