CVE-2019-25072 Uncontrolled resource consumption in github.com/tendermint/tendermint

2022-12-2721:13:24

www.cve.org

uncontrolled resource consumption

github.com/tendermint/tendermint

gzip compression

denial of service

0.001 Low

EPSS

Percentile

41.0%

JSON

Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.

CNA Affected

[
  {
    "vendor": "github.com/tendermint/tendermint",
    "product": "github.com/tendermint/tendermint/rpc/lib/client",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "github.com/tendermint/tendermint/rpc/lib/client",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.31.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "makeHTTPClient"
      },
      {
        "name": "NewJSONRPCClient"
      },
      {
        "name": "NewURIClient"
      }
    ],
    "defaultStatus": "unaffected"
  }
]