Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2017-16013

UNKNOWN
Published 2018-06-04T19:00:00Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2017-16013. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown. This may cause hapi to crash or to hang the client connection until the timeout period is reached.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

HackerOne

hapi node module

Affected Versions:

>= 15.0.0 <= 16.1.0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

Denial of Service via malformed accept-encoding header in hapi

GHSA-cqjg-whmm-8gv6

Advisory Details

Affected versions of `hapi` will crash or lock the event loop when a malformed `accept-encoding` header is recieved. ## Recommendation Update to version 16.1.1 or later.

Affected Packages

npm hapi
ECOSYSTEM: ≥15.0.0 <16.1.1

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2017-16013
WEB https://github.com/hapijs/hapi/issues/3466
ADVISORY https://github.com/advisories/GHSA-cqjg-whmm-8gv6
WEB https://www.npmjs.com/advisories/335

Advisory provided by GitHub Security Advisory Database. Published: October 9, 2018, Modified: September 7, 2023

References

https://nodesecurity.io/advisories/335
https://github.com/hapijs/hapi/issues/3466
Published: 2018-06-04T19:00:00Z
Last Modified: 2024-09-17T04:09:41.605Z
Copied to clipboard!