Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1taDU1LWdxdmYteGZ3bc4AA9m0

Denial of service via malicious preflight requests in github.com/rs/cors

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Permalink: https://github.com/advisories/GHSA-mh55-gqvf-xfwm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1taDU1LWdxdmYteGZ3bc4AA9m0
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 5 months ago
Updated: 5 months ago

Identifiers: GHSA-mh55-gqvf-xfwm
References:

• https://github.com/rs/cors/issues/170
• https://github.com/rs/cors/pull/171
• https://github.com/rs/cors/commit/4c32059b2756926619f6bf70281b91be7b5dddb2
• https://github.com/advisories/GHSA-mh55-gqvf-xfwm

Repository: https://github.com/rs/cors
Blast Radius: 0.0

Affected Packages