GHSA-45xm-v8gq-7jqx

Suggest an improvement
Source
https://github.com/advisories/GHSA-45xm-v8gq-7jqx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-45xm-v8gq-7jqx/GHSA-45xm-v8gq-7jqx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-45xm-v8gq-7jqx
Aliases
Published
2018-10-17T16:19:59Z
Modified
2024-03-15T05:19:58.705082Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Excessive memory allocation
Details

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.

Database specific 
{
    "nvd_published_at": "2018-10-10T20:29:00Z",
    "cwe_ids": [
        "CWE-119",
        "CWE-789"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:57:32Z"
}
References

Affected packages

Maven / io.vertx:vertx-core

Package

Name
io.vertx:vertx-core
View open source insights on deps.dev
Purl
pkg:maven/io.vertx/vertx-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.5.4

Affected versions

3.*

3.0.0
3.0.0-dev_preview1
3.1.0
3.2.0
3.2.1
3.3.0.CR1
3.3.0.CR2
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0.Beta1
3.4.0
3.4.1
3.4.2
3.5.0.Beta1
3.5.0
3.5.1
3.5.2.CR1
3.5.2.CR2
3.5.2.CR3
3.5.2
3.5.3.CR1
3.5.3