CVE-2024-22019

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22019
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/03/11/1 Mailing List Third Party Advisory
https://hackerone.com/reports/2233486 Issue Tracking
https://security.netapp.com/advisory/ntap-20240315-0004/ Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/11/1 Mailing List Third Party Advisory
https://hackerone.com/reports/2233486 Issue Tracking
https://security.netapp.com/advisory/ntap-20240315-0004/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Configuration 2 (hide)

cpe:2.3:a:netapp:astra_control_center:-:*:*:*:*:*:*:*
History

02 Apr 2025, 20:10

Type Values Removed Values Added
CPE cpe:2.3:a:netapp:astra_control_center:-:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
First Time Nodejs
Nodejs node.js
Netapp
Netapp astra Control Center
References () http://www.openwall.com/lists/oss-security/2024/03/11/1 - () http://www.openwall.com/lists/oss-security/2024/03/11/1 - Mailing List, Third Party Advisory
References () https://hackerone.com/reports/2233486 - () https://hackerone.com/reports/2233486 - Issue Tracking
References () https://security.netapp.com/advisory/ntap-20240315-0004/ - () https://security.netapp.com/advisory/ntap-20240315-0004/ - Third Party Advisory

21 Nov 2024, 08:55

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/03/11/1 - () http://www.openwall.com/lists/oss-security/2024/03/11/1 -
References () https://hackerone.com/reports/2233486 - () https://hackerone.com/reports/2233486 -
References () https://security.netapp.com/advisory/ntap-20240315-0004/ - () https://security.netapp.com/advisory/ntap-20240315-0004/ -

05 Nov 2024, 21:35

Type Values Removed Values Added
CWE CWE-404

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/03/11/1 -

15 Mar 2024, 11:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240315-0004/ -

20 Feb 2024, 19:50

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en los servidores HTTP de Node.js permite a un atacante enviar una solicitud HTTP especialmente manipulada con codificación fragmentada, lo que provoca el agotamiento de los recursos y la denegación de servicio (DoS). El servidor lee una cantidad ilimitada de bytes de una única conexión, aprovechando la falta de limitaciones en los bytes de extensión de fragmentos. El problema puede provocar el agotamiento del ancho de banda de la CPU y de la red, pasando por alto salvaguardas estándar como tiempos de espera y límites de tamaño corporal.

20 Feb 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-20 02:15

Updated : 2025-04-02 20:10

NVD link : CVE-2024-22019

Mitre link : CVE-2024-22019

CVE.ORG link : CVE-2024-22019

JSON object : View

Products Affected

nodejs

  • node.js

netapp

  • astra_control_center
CWE
CWE-404

Improper Resource Shutdown or Release