CVE-2017-16013: Input Validation
Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved.
Recommendation
Update to version 16.1.1 or later.
Other sources
hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed accept-encoding header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16013?
CVE-2017-16013 is classified as a moderate severity vulnerability due to its potential to crash or lock the event loop.
How do I fix CVE-2017-16013?
To fix CVE-2017-16013, update the hapi framework to version 16.1.1 or later.
What version of hapi is affected by CVE-2017-16013?
CVE-2017-16013 affects hapi versions between 15.0.0 and 16.1.0 inclusive.
Can CVE-2017-16013 lead to denial of service?
Yes, CVE-2017-16013 can lead to denial of service by crashing or locking the event loop.
Is the vulnerability CVE-2017-16013 easy to exploit?
Exploitation of CVE-2017-16013 can be easily triggered with a malformed accept-encoding header.