CVE-2019-5645: rapid7 metasploit Uncontrolled Resource Consumption
Vulnerability summary
CVE-2019-5645 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in rapid7 metasploit. EPSS estimates a 41.69% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 01-09-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on the Metasploit server.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
41.69%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 41.69% on 22-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMetasploit HTTP(S) handler DoS
auxiliary/dos/http/metasploit_httphandler_dos
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Rapid72 products
- metasploit≤ 5.0.27
- metasploit framework5.0.27
1 vendor · 2 products