CVE-2021-32640 ReDoS in Sec-Websocket-Protocol header

🗓️ 25 May 2021 18:25:09Reported by GitHub_MType

CVE-2021-32640 ReDoS in Sec-Websocket-Protocol header. Fix in [email protected].

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System.	16 Aug 202217:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator on Cloud Pak for Data is vulnerable to multiple vulnerabilities	12 Dec 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace has addressed multiple vulnerabilities	27 Mar 202420:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	5 Dec 202219:00	–	ibm
BDU FSTEC	The vulnerability of the client-server WebSocket library in Node-ws software, related to uncontrolled resource consumption, allows attackers to trigger a service failure.	5 Oct 202100:00	–	bdu_fstec
Circl	CVE-2021-32640	7 Apr 202615:02	–	circl
CNNVD	github ws 资源管理错误漏洞	25 May 202100:00	–	cnnvd
CVE	CVE-2021-32640	25 May 202118:25	–	cve
Debian CVE	CVE-2021-32640	25 May 202118:25	–	debiancve
EUVD	EUVD-2021-0968	7 Oct 202500:30	–	euvd

[
  {
    "product": "ws",
    "vendor": "websockets",
    "versions": [
      {
        "status": "affected",
        "version": ">= 5.0.0 <= 7.4.5"
      }
    ]
  }
]

Source	Link
github	www.github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693
github	www.github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff
lists	www.lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30%40%3Ccommits.tinkerpop.apache.org%3E
security	www.security.netapp.com/advisory/ntap-20210706-0005/

06 Jul 2021 07:06Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.3

EPSS0.01154

CWE-400