AZL-44670

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-44670.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-44670

Upstream

CVE-2021-32640

Published

2021-05-25T19:15:07Z

Modified

2026-04-21T04:31:26.857626Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

CVE-2021-32640 affecting package js-jquery 3.5.0-4

Details

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-32640

Affected packages

Azure Linux:3 / js-jquery

Package

Name: js-jquery
Purl: pkg:rpm/azure-linux/js-jquery

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

3.5.0-4

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-44670.json"