CVE-2024-37890 Denial of service when handling a request with many HTTP headers in ws
Attackers can crash a ws server by sending requests with excessive HTTP headers, affecting Node.js applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-37890?
CVE-2024-37890 is a high-severity denial of service vulnerability in websockets ws, published on 17 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Weakness: CWE-476
Which versions are affected by CVE-2024-37890?
8 open source packages ship an affected version, including ws.
| Package | Affected | Fixed in |
|---|---|---|
ws npm | From 2.1.0 | 5.2.4 |
ws npm | From 2.1.0 | 5.2.4 |
ws npm | From 6.0.0 | 6.2.3 |
ws npm | From 6.0.0 | 6.2.3 |
ws npm | From 7.0.0 | 7.5.10 |
ws npm | From 7.0.0 | 7.5.10 |
2 more packages
ws npm | From 8.0.0 | 8.17.1 |
ws npm | From 8.0.0 | 8.17.1 |
Linux distribution packages (32)
aspnetcore-runtime-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
aspnetcore-runtime-dbg-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
aspnetcore-targeting-pack-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
dotnet-apphost-pack-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
dotnet-apphost-pack-8.0-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
dotnet-hostfxr-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
dotnet-hostfxr-8.0-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
dotnet-runtime-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
dotnet-runtime-8.0-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
dotnet-runtime-dbg-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
dotnet-sdk-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.113-2.el10_0 |
dotnet-sdk-8.0-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.113-2.el10_0 |
dotnet-sdk-8.0-source-built-artifacts Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.113-2.el10_0 |
dotnet-sdk-dbg-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.113-2.el10_0 |
dotnet-targeting-pack-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.13-2.el10_0 |
dotnet-templates-8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.113-2.el10_0 |
dotnet8.0 Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.113-2.el10_0 |
dotnet8.0-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:8.0.113-2.el10_0 |
aspnetcore-runtime-6.0 Red Hat:enterprise_linux:9::appstream | All versions | 0:6.0.35-2.el9_5 |
aspnetcore-runtime-8.0 Red Hat:enterprise_linux:9::appstream | All versions | 0:8.0.10-3.el9_5 |
aspnetcore-runtime-dbg-8.0 Red Hat:enterprise_linux:9::appstream | All versions | 0:8.0.10-3.el9_5 |
aspnetcore-targeting-pack-6.0 Red Hat:enterprise_linux:9::appstream | All versions | 0:6.0.35-2.el9_5 |
aspnetcore-targeting-pack-8.0 Red Hat:enterprise_linux:9::appstream | All versions | 0:8.0.10-3.el9_5 |
dotnet-apphost-pack-6.0 Red Hat:enterprise_linux:9::appstream | All versions | 0:6.0.35-2.el9_5 |
dotnet-apphost-pack-6.0-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:6.0.35-2.el9_5 |
dotnet-apphost-pack-8.0 Red Hat:enterprise_linux:9::appstream | All versions | 0:8.0.10-3.el9_5 |
dotnet-apphost-pack-8.0-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:8.0.10-3.el9_5 |
dotnet-hostfxr-6.0 Red Hat:enterprise_linux:9::appstream | All versions | 0:6.0.35-2.el9_5 |
dotnet-hostfxr-6.0-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:6.0.35-2.el9_5 |
dotnet-hostfxr-8.0 Red Hat:enterprise_linux:9::appstream | All versions | 0:8.0.10-3.el9_5 |
dotnet-hostfxr-8.0-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:8.0.10-3.el9_5 |
dotnet-runtime-6.0 Red Hat:enterprise_linux:9::appstream | All versions | 0:6.0.35-2.el9_5 |
How do I fix CVE-2024-37890?
Upgrade ws to a fixed version for your release line: 5.2.4, 6.2.3, 7.5.10 or 8.17.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-37890 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-37890 exists.
Sources
Also known as AZL-42808, AZL-43600, AZL-45066, CLSA-2026-1773360970, CLSA-2026-1774225216, CLSA-2026-1785380886 and 12 more.