Denial of service when handling a request with many HTTP headers in ws
Priority HIGH 72CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 16 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-476.
Summary
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01357 71st percentileScored 2026-11-07
Fix Partial ws (websockets): 5.2.4, 6.2.3, 7.5.10 +1ws (npm): 5.2.4, 6.2.3, 7.5.10 +1Red Hat: 8 advisoriesRed Hat: 10 fixed, 16 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| websockets | ws | 2.1.0 to before 5.2.4; 6.0.0 to before 6.2.3; 7.0.0 to before 7.5.10; 8.0.0 to before 8.17.1 | 5.2.4, 6.2.3, 7.5.10, 8.17.1 | Patch available | CNA |
| — | ws (npm) | 2.1.0 to before 5.2.4 | 5.2.4 | Patch available | GHSA-3h5v-q93c-6h6q |
| — | ws (npm) | 6.0.0 to before 6.2.3 | 6.2.3 | Patch available | GHSA-3h5v-q93c-6h6q |
| — | ws (npm) | 7.0.0 to before 7.5.10 | 7.5.10 | Patch available | GHSA-3h5v-q93c-6h6q |
| — | ws (npm) | 8.0.0 to before 8.17.1 | 8.17.1 | Patch available | GHSA-3h5v-q93c-6h6q |
- ws Vendorwebsockets Affected 2.1.0 to before 5.2.4; 6.0.0 to before 6.2.3; 7.0.0 to before 7.5.10; 8.0.0 to before 8.17.1 Fixed in 5.2.4, 6.2.3, 7.5.10, 8.17.1 Patch available CNA
- ws (npm) Vendor— Affected 2.1.0 to before 5.2.4 Fixed in 5.2.4 Patch available GHSA-3h5v-q93c-6h6q
- ws (npm) Vendor— Affected 6.0.0 to before 6.2.3 Fixed in 6.2.3 Patch available GHSA-3h5v-q93c-6h6q
- ws (npm) Vendor— Affected 7.0.0 to before 7.5.10 Fixed in 7.5.10 Patch available GHSA-3h5v-q93c-6h6q
- ws (npm) Vendor— Affected 8.0.0 to before 8.17.1 Fixed in 8.17.1 Patch available GHSA-3h5v-q93c-6h6q
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:websockets:ws:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA ws (websockets) Fixed in 5.2.4, 6.2.3, 7.5.10, 8.17.1
- Fix · GHSA-3h5v-q93c-6h6q ws (npm) Fixed in 5.2.4 Advisory →
- Fix · GHSA-3h5v-q93c-6h6q ws (npm) Fixed in 6.2.3 Advisory →
- Fix · GHSA-3h5v-q93c-6h6q ws (npm) Fixed in 7.5.10 Advisory →
- Fix · GHSA-3h5v-q93c-6h6q ws (npm) Fixed in 8.17.1 Advisory →
Red Hat 8 advisories
- RHSA-2026:83548 Released 2026-10-15 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2026:3712 Released 2026-03-04 · Red Hat rating ImportantRed Hat OpenShift Pipelines Release 1.15.4
- Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8 +2
- RHSA-2026:3710 Released 2026-03-04 · Red Hat rating ImportantRed Hat OpenShift Pipelines Release 1.15.3
- Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8 +2
Show 5 more Red Hat advisories
- RHSA-2025:8551 Released 2025-06-04 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.14.18 Bug Fix Update
- RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9 +1
- RHSA-2025:8544 Released 2025-06-04 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.15.14 Bug Fix Update
- RHODF 4.15 for RHEL 9 odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +2
- RHSA-2024:6755 Released 2024-09-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.2 security and bug fix update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9 +7
- RHSA-2024:5547 Released 2024-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.1 bug fix and security update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +2
- RHSA-2024:4591 Released 2024-07-17 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| .NET 6.0 on Red Hat Enterprise Linux | Affected | No fix planned: Out of support scope |
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Runtimes | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| RHODF 4.14 for RHEL 9 | Fixed | RHSA-2025:8551 |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2025:8544 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2024:4591, RHSA-2024:5547, RHSA-2024:6755 |
| Red Hat Ceph Storage 7.1 | Fixed | RHSA-2026:83548 |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | — |
| Red Hat Developer Hub 1.3 for RHEL 9 | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | — |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | — |
| Red Hat OpenShift Pipelines 1.15 | Fixed | RHSA-2026:3710 |
Not affected: 24 products
- Cryostat 2
- Multicluster Engine for Kubernetes
- RHODF 4.14 for RHEL 9
- RHODF 4.15 for RHEL 9
- RHODF 4.16 for RHEL 9
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Keycloak
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 7.1
- Red Hat Data Grid 8
- Red Hat Developer Hub 1.3 for RHEL 9
- Red Hat Discovery 1
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat OpenShift Pipelines 1.15
- Red Hat Process Automation 7
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apicurio Registry 2
- Red Hat build of OptaPlanner 8
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37890
- 2026-10-03 Alias added: GHSA-3h5v-q93c-6h6q
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-07 Affected versions changed · Red Hat
- 2026-10-10 Fix available: Red Hat CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9) +1 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83548 · Red Hat
- 2026-10-16 Fix available: Red Hat Ceph Storage 7.1 · Red Hat
References
Other 9
- https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
- https://github.com/websockets/ws/issues/2230
- https://github.com/websockets/ws/pull/2231
- https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
- https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
- https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
- https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
- https://nodejs.org/api/http.html#servermaxheaderscount
- https://github.com/websockets/ws
More websockets vulnerabilities
- TI-2026-36049 ws: Memory exhaustion DoS from tiny fragments and data chunks CVSS 3.1HIGH 7.5
- TI-2026-33473 ws: Uninitialized memory disclosure CVSS 3.1HIGH 7.5
- TI-2016-08584 Uncontrolled resource consumption in HackerOne ws node module CVSS 3.0HIGH 7.5
- TI-2016-08560 Memory corruption in HackerOne ws node module CVSS 3.0HIGH 7.5
- TI-2021-12308 ReDoS in Sec-Websocket-Protocol header CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-37890 · CVE Program
- CVE-2024-37890 · NVD
- FIRST EPSS
- GHSA-3h5v-q93c-6h6q · GitHub Advisory Database · CC BY 4.0
- CVE-2024-37890 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences