CVE-2024-22019: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS).
Other sources
Node.js is vulnerable to a denial of service, caused by an error when reading unprocessed HTTP request with unbounded chunk extension. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to exhaust all available resources.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodeto a version that resolves this vulnerability.Fixed in 18.19.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.19.1Fixed in 20.11.1Fixed in 21.6.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.19.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.6.2 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.19.1+dfsg-1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.21.0+dfsg+~cs24.13.4-1Fixed in 24.22.2+dfsg+~cs24.19.2-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-22019?
CVE-2024-22019 is considered a high severity vulnerability.
How do I fix CVE-2024-22019?
To mitigate CVE-2024-22019, upgrade Node.js to version 18.19.1 or apply the appropriate patches for IBM Cognos Analytics.
What does CVE-2024-22019 impact?
CVE-2024-22019 impacts Node.js HTTP servers, allowing for denial of service through resource exhaustion.
Is CVE-2024-22019 a denial of service vulnerability?
Yes, CVE-2024-22019 allows an attacker to perform a denial of service attack by exhausting server resources.
How is CVE-2024-22019 exploited?
CVE-2024-22019 can be exploited by sending specially crafted HTTP requests with chunked encoding to the affected servers.