CVE-2021-22883

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:20.3.1.2:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:21.0.0.2:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*

Information

Published : 2021-03-03 18:15

Updated : 2021-10-20 11:16


NVD link : CVE-2021-22883

Mitre link : CVE-2021-22883


JSON object : View

Products Affected

nodejs

  • node.js

netapp

  • e-series_performance_analyzer

oracle

  • nosql_database
  • graalvm

fedoraproject

  • fedora
CWE
CWE-400

Uncontrolled Resource Consumption