PT-2020-19691

Name of the Vulnerable Software and Affected Versions websocket-extensions ruby module versions prior to 0.1.5 Description The issue allows for Denial of Service DoS via Regex Backtracking. An attacker can exploit this by providing a malicious payload with the Sec-WebSocket-Extensions header,...

CVE-2020-7662: Undefined Security Weakness

websocket-extensions npm module prior to 0.1.4 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...

CVE-2020-7663: Undefined Security Weakness

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...

PT-2020-19690

Name of the Vulnerable Software and Affected Versions websocket-extensions npm module versions prior to 0.1.4 Description The issue allows for Denial of Service DoS via Regex Backtracking. An attacker can exploit this by sending a malicious payload with the Sec-WebSocket-Extensions header, causin...

GHSA-5V72-XG48-5RPM Denial of Service in ws

Affected versions of ws can crash when a specially crafted Sec-WebSocket-Extensions header containing Object.prototype property names as extension or parameter names is sent. Proof of concept const WebSocket = require'ws'; const net = require'net'; const wss = new WebSocket.Server port: 3000 ,...

PT-2019-20007

Name of the Vulnerable Software and Affected Versions ws versions prior to 3.3.1 Description The issue arises when a specially crafted Sec-WebSocket-Extensions header is sent, containing Object.prototype property names as extension or parameter names, which can cause affected versions of ws to...

ws - Denial of Service

This module exploits a Denial of Service vulnerability in npm module "ws". By sending a specially crafted value of the Sec-WebSocket-Extensions header on the initial WebSocket upgrade request, the ws component will crash. This module requires Metasploit: https://metasploit.com/download Current...