Hash flooding vulnerability in aeson

2023-06-1309:03:52

Google

osv.dev

aeson

hash flooding

denial of service

cpu consumption

real-world attacks

unordered-containers

hashmap implementation

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

49.7%

JSON

Hash flooding vulnerability in aeson

aeson was vulnerable to hash flooding (a.k.a. hash DoS). The
issue is a consequence of the HashMap implementation from
unordered-containers. It results in a denial of service through
CPU consumption. This technique has been used in real-world attacks
against a variety of languages, libraries and frameworks over the
years.