CVE-2021-41119: DoS vulnerabiliity in wire-server json parser
Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-41119?
CVE-2021-41119 is a vulnerability in the Wire-server system server that allows a denial of service attack via a crafted object causing a hash collision.
How severe is CVE-2021-41119?
CVE-2021-41119 has a severity rating of 7.5 (high).
How does CVE-2021-41119 affect the Wire-server software?
CVE-2021-41119 affects Wire-server releases prior to v2022-03-01.
How can CVE-2021-41119 be exploited?
CVE-2021-41119 can be exploited by sending a crafted object to the Wire-server, causing a hash collision and leading to a denial of service.
Is there a fix available for CVE-2021-41119?
Yes, the fix for CVE-2021-41119 is to upgrade to Wire-server v2022-03-01 or later.