Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ReDoS in Sec-Websocket-Protocol header
Vulnerability Description
ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Vulnerability Title
github ws 资源管理错误漏洞
Vulnerability Description
github ws是一个应用软件。一种易于使用，运行迅速且经过全面测试的WebSocket客户端和服务器实现的方法。 ws 7.4.6之前版本存在安全漏洞，该漏洞源于“Sec-Websocket-Protocol”标头的一个特殊的值可以用来显著降低ws服务器的速度。
CVSS Information
N/A
Vulnerability Type
N/A