← Back

CVE-2021-22883

nvd nist
Published: Mar 3, 2021Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

Affected (17)

Show all products
Nodejs: Node.js · Fedoraproject: Fedora · Netapp: E Series Performance Analyzer · Oracle: Graalvm, Jd Edwards Enterpriseone Tools, Mysql Cluster, Nosql Database, Peoplesoft Enterprise Peopletools · Siemens: Sinec Infrastructure Network Services
Nodejs
1 product
Node.js
Fedoraproject
1 product
Fedora
Netapp
1 product
E Series Performance Analyzer
Oracle
5 products
Graalvm
Jd Edwards Enterpriseone Tools
Mysql Cluster
Nosql Database
Peoplesoft Enterprise Peopletools
Siemens
1 product
Sinec Infrastructure Network Services
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Nodejs
Node.js
From 15.0.0 to 15.10.0
Node.js
From 10.0.0 to 10.24.0
Node.js
From 12.0.0 to 12.21.0
Node.js
From 14.0.0 to 14.16.0
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 32
Fedora
Version 33
Fedora
Version 34
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
E Series Performance Analyzer
All versions
Configuration D
8 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Graalvm
Version 19.3.5
Graalvm
Version 20.3.1.2
Graalvm
Version 21.0.0.2
Jd Edwards Enterpriseone Tools
Before 9.2.6.0
Mysql Cluster
Up to 8.0.25
Nosql Database
Before 20.3
Oracle
Peoplesoft Enterprise Peopletools
Version 8.58
Peoplesoft Enterprise Peopletools
Version 8.59
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
Sinec Infrastructure Network Services
Before 1.0.1.1

Related CWEs

CWE-400
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CWE-772
Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

References (20)

Source: support@hackerone.com
PatchThird Party Advisory
Source: support@hackerone.com
Permissions RequiredThird Party Advisory
Source: support@hackerone.com
Source: support@hackerone.com
Source: support@hackerone.com
Source: support@hackerone.com
PatchRelease NotesVendor Advisory
Source: support@hackerone.com
Third Party Advisory
Source: support@hackerone.com
PatchThird Party Advisory
Source: support@hackerone.com
PatchThird Party Advisory
Source: support@hackerone.com
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions RequiredThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchRelease NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.