REDHAT-BUG-2240110: Medium severity tungstenite vulnerability
The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2240110?
The severity of REDHAT-BUG-2240110 is critical as it allows remote attackers to cause a denial of service.
How do I fix REDHAT-BUG-2240110?
To fix REDHAT-BUG-2240110, upgrade Tungstenite to version 0.21.0 or later.
What versions are affected by REDHAT-BUG-2240110?
REDHAT-BUG-2240110 affects Tungstenite versions up to and including 0.20.0.
Can REDHAT-BUG-2240110 lead to data loss?
While REDHAT-BUG-2240110 primarily causes a denial of service, it does not directly lead to data loss.
Who is impacted by REDHAT-BUG-2240110?
Users of the Tungstenite crate for Rust versions 0.20.0 and earlier are impacted by REDHAT-BUG-2240110.