CVE - CVE-2024-37890

CVE-ID
CVE-2024-37890	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f URL:https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f MISC:https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e URL:https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e MISC:https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c URL:https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c MISC:https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63 URL:https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63 MISC:https://github.com/websockets/ws/issues/2230 URL:https://github.com/websockets/ws/issues/2230 MISC:https://github.com/websockets/ws/pull/2231 URL:https://github.com/websockets/ws/pull/2231 MISC:https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q URL:https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q MISC:https://nodejs.org/api/http.html#servermaxheaderscount URL:https://nodejs.org/api/http.html#servermaxheaderscount
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20240610	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240610)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)