CVE-2016-2515

Published: Apr 13, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.

Affected (2)

Products: Hawk Project: Hawk

Hawk Project

1 product

Hawk

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Hawk Project Hawk	Version 3.1.2
Hawk Project Hawk	Version 4.1.0

Related CWEs

CWE-399

References (12)

http://www.openwall.com/lists/oss-security/2016/02/20/1

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2016/02/20/2

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1309721

Source: secalert@redhat.com

https://github.com/hueniverse/hawk/commit/0833f99ba64558525995a7e21d4093da1f3e15fa

Source: secalert@redhat.com

Patch

https://github.com/hueniverse/hawk/issues/168

Source: secalert@redhat.com

Patch

https://nodesecurity.io/advisories/77

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2016/02/20/1