CVE-2019-5739

CWE-400 — Uncontrolled Resource ConsumptionCWE-770 — Allocation without Limits8 documents7 sources
Severity
7.5HIGH
EPSS
0.3%
top 45.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Nodejs Node.jsNode.js Node.jsOpensuse Leap
Timeline
PublishedMar 28
Latest updateMay 13

Description

Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶Debiannodejs< 8.9.3~dfsg-5+3
▶NVDnodejs/node.js6.16.0
▶CVEListV5node.js/node.jsAll versions prior to 6.17.0
▶NVDopensuse/leap42.3

🔴Vulnerability Details

3
GHSA
GHSA-wr35-fh22-q84x: Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node↗2022-05-13
▶
CVEList
CVE-2019-5739: Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node↗2019-03-28
▶
OSV
CVE-2019-5739: Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node↗2019-03-28
▶

📋Vendor Advisories

2
Red Hat
nodejs: DoS with keep-alive HTTP connection↗2019-02-28
▶
Debian
CVE-2019-5739: nodejs - Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 m...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-5739 nodejs: DoS with keep-alive HTTP connection↗2019-03-20
▶
Bugzilla
CVE-2019-5739 nodejs: DoS with keep-alive HTTP connection [epel-7]↗2019-03-20
▶
CVE-2019-5739 (HIGH CVSS 7.5) | Keep-alive HTTP and HTTPS connectio | cvebase.io