CVE-2015-9241: hackerone hapi node module Uncontrolled Resource Consumption
Vulnerability summary
CVE-2015-9241 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in hackerone hapi node module. EPSS estimates a 2.10% chance of exploitation in the next 30 days, higher than 81.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 29-05-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.10%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
-0.03 pp
From 2.14% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNode Ecstatic
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
3 vendors · 3 products
References
6 links- github.com/jfhbrook/node-ecstatic/pull/179X Refsource MISCExploitIssue TrackingThird Party AdvisoryWEB
- github.com/hapijs/hapi/commit/aab2496e930dce5ee1ab28eecec94e0e45f03580X Refsource MISCPatchThird Party AdvisoryWEB
