CVE-2016-2515 Regular Expression Denial of Service in hawk
Remote attackers can cause denial of service via CPU exhaustion using long headers or URIs in the Hawk library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-2515?
CVE-2016-2515 is a high-severity denial of service vulnerability in n/a, published on 13 Apr 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.
Weakness: CWE-399
Which versions are affected by CVE-2016-2515?
4 open source packages ship an affected version, including hawk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hawk npm | All versions | 3.1.3 |
hawk npm | All versions | 3.1.3 |
hawk npm | From 4.0.0 | 4.1.1 |
hawk npm | From 4.0.0 | 4.1.1 |
Products include Hawk Project Hawk.
How do I fix CVE-2016-2515?
Upgrade hawk to a fixed version for your release line: 3.1.3 or 4.1.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-2515 being exploited?
There is no known exploitation of CVE-2016-2515 in the wild and no public exploit code.
Sources
Also known as GHSA-jcpv-g9rr-qxrc.