CVE-2024-27922

Published: Mar 21, 2024Modified: Jan 2, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may vary depending on the specific usage of the package but it can potentially affect any system where this package is in use. The problem has been patched in version 2.0.2. As of time of publication, no specific workaround strategies have been disclosed.

Affected (1)

Products: Tomphttp: Tomp Bare Server

1 product

Tomp Bare Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tomphttp Tomp Bare Server	Before 2.0.2

Related CWEs

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (2)

https://github.com/tomphttp/bare-server-node/security/advisories/GHSA-86fc-f9gr-v533

Source: security-advisories@github.com

Vendor Advisory

https://github.com/tomphttp/bare-server-node/security/advisories/GHSA-86fc-f9gr-v533

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.