ByteOS Network

CVE Vulnerability Details :

CVE-2024-32652

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-19 Apr, 2024 | 18:29

Updated At-02 Aug, 2024 | 02:13

▼CVE Numbering Authority (CNA)

@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed

The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.

Affected Products

Vendor

honojs

Product

node-server

Versions

Affected

>= 1.3.0, < 1.10.1

Problem Types

Type	CWE ID	Description
CWE	CWE-755	CWE-755: Improper Handling of Exceptional Conditions

Metrics

Version	Base score	Base severity	Vector
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Hyperlink	Resource
https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx	x_refsource_CONFIRM
https://github.com/honojs/node-server/issues/159	x_refsource_MISC
https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204	x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CISA ADP Vulnrichment

Affected Products

Vendor

hono

Product

node-server

CPEs

cpe:2.3:a:hono:node-server:*:*:*:*:*:node.js:*:*

Default Status

unknown

Versions

Affected

From 1.3.0 before 1.10.1 (custom)

Metrics Other Info

2. CVE Program Container

References

Hyperlink	Resource
https://github.com/honojs/node-server/security/advisories/GHSA-hgxw-5xg3-69jx	x_refsource_CONFIRM x_transferred
https://github.com/honojs/node-server/issues/159	x_refsource_MISC x_transferred
https://github.com/honojs/node-server/commit/d847e60249fd8183ba0998bc379ba20505643204	x_refsource_MISC x_transferred

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Affected

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References