PT-2018-6043

CVE-2017-16013

Published

2018-06-04

Updated

2019-10-09

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: hapi versions 15.0.0 through 16.1.0

Description: The issue occurs when hapi encounters a malformed accept-encoding header, which may cause it to crash or hang the client connection until the timeout period is reached. Affected versions of hapi will crash or lock the event loop when such a header is received.

Recommendations: Update to version 16.1.1 or later.

Exploitability

Fix

Impacts

Researchers

Geoand

George

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption

CWE-20: Improper Input Validation