جزئیات آسیب‌پذیری
CVE-2026-48779
Red Hat Node HealthCheck OperatorRed Hat OpenShift LightspeedRed Hat OpenShift PipelinesRed Hat Ansible Automation Platform 2Red Hat Build of Podman DesktopRed Hat Build of Podman Desktop - Tech Preview
ws: Memory exhaustion DoS from tiny fragments and data chunks
CVSS 3.1
7.5بالا
شرح رسمی (انگلیسی)
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | Node HealthCheck Operator | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Node HealthCheck Operator | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Node HealthCheck Operator | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Podman Desktop | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Connectivity Link 1 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 9 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Quay 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Satellite 6 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | همه | CVEProject cvelistV5 (CNA) |
| websockets | ws | >= 1.1.0, < 5.2.5 | CVEProject cvelistV5 (CNA) |
| websockets | ws | >= 6.0.0, < 6.2.4 | CVEProject cvelistV5 (CNA) |
| websockets | ws | >= 7.0.0, < 7.5.11 | CVEProject cvelistV5 (CNA) |
| websockets | ws | >= 8.0.0, < 8.21.0 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۳۲- https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7 x_refsource_MISC
- https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53 x_refsource_MISC
- https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94 x_refsource_MISC
- https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8 x_refsource_MISC
- https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-48779 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2489661 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:48151 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34342 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57590 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66488 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36754 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33574 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29197 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41928 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65126 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60520 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33155 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33160 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33163 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33173 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33183 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56431 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41941 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41944 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56366 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57013 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40984 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37272 vendor-advisoryx_refsource_REDHAT
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۳/۲۷
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۲۰
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
۱٫۴۲٪
احتمال بهره‌برداری در ۳۰ روز
۷۳٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-400Uncontrolled Resource Consumption
- CWE-770Allocation of Resources Without Limits or Throttling
- CWE-1050Excessive Platform Resource Consumption within a Loop