CVE-2018-21035 Denial of service in n/a
Attackers can cause denial of service via memory consumption by sending large WebSocket frames, as Qt lacks configurable size limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-21035?
CVE-2018-21035 is a high-severity denial of service vulnerability in Qt Qt, published on 28 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).
Weakness: CWE-770
Which versions are affected by CVE-2018-21035?
It affects 1 product.
Products include Qt Qt.
How do I fix CVE-2018-21035?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-21035 being exploited?
There is no known exploitation of CVE-2018-21035 in the wild and no public exploit code.
Other vulnerabilities in Qt Qt
Sources
Also known as AZL-6833, DEBIAN-CVE-2018-21035, GHSA-xhq4-5269-2ffv, MGASA-2021-0270, UBUNTU-CVE-2018-21035.