CVE-2018-12541CWE-789

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding…

published October 10, 2018

CVSS
—
EPSS
3%
Percentile
85.5
In the wild
Unconfirmed
What it is

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02652 · 85.5th percentile
Weakness
CWE-789 · Memory Allocation with Excessive Size Value
Published
2018-10-10T20:00Z
EPSS history
Timeline
  • 10 OCT 20:00Z
    In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding…
    cvelistv5