1. Home
  2. Vulnerabilities
  3. CVE-2018-12541

CVE-2018-12541

CVSS v3.1 6.5 (Medium)
65% Progress
CVSS v2.0 4 (Medium)
40% Progress
EPSS 0.31 % (71th)
0.31% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Graph Web & Social Timeline

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.

Weaknesses
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-789
Memory Allocation with Excessive Size Value
CVE Status
PUBLISHED
CNA
Eclipse Foundation
Published Date
2018-10-10 20:29:00
(6 years ago)
Updated Date
2023-11-07 02:52:20
(10 months ago)

Affected Products

Eclipse

Configuration #1

    CPE23 From Up To
  Eclipse Vert.x from 3.0.0 version and prior 3.5.4 version cpe:2.3:a:eclipse:vert.x >= 3.0.0 < 3.5.4