CVE-2024-22019: netapp astra_control_center Improper Resource Shutdown or Release
Vulnerability summary
CVE-2024-22019 is a high (CVSS 7.5) Improper Resource Shutdown or Release vulnerability in netapp astra_control_center. EPSS estimates a 3.17% chance of exploitation in the next 30 days, higher than 88% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 3% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 20 · Related 12Timeline
- 20-02-2024PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.17%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat17 products
- nodejs< 1:16.20.2-4.el9_0 | < 1:16.20.2-4.el9_3 | < 1:16.20.2-4.el9_2 | < 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 | < 1:16.20.2-4.module+el8.6.0+21547+94389150
- nodejs-debuginfo< 1:16.20.2-4.el9_0 | < 1:16.20.2-4.el9_3 | < 1:16.20.2-4.el9_2 | < 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 | < 1:16.20.2-4.module+el8.6.0+21547+94389150
- nodejs-debugsource< 1:16.20.2-4.el9_0 | < 1:16.20.2-4.el9_3 | < 1:16.20.2-4.el9_2 | < 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 | < 1:16.20.2-4.module+el8.6.0+21547+94389150
- nodejs-devel< 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 | < 1:16.20.2-4.module+el8.6.0+21547+94389150
- nodejs-docs< 1:16.20.2-4.el9_0 | < 1:16.20.2-4.el9_3 | < 1:16.20.2-4.el9_2 | < 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 | < 1:16.20.2-4.module+el8.6.0+21547+94389150
Nodejs2 products
- node≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.* | ≥ 17.0, < 17.* | ≥ 18.0, < 18.19.1 | ≥ 19.0, < 19.* | ≥ 20.0, < 20.11.1 | ≥ 21.0, < 21.6.2
- node.js≥ 18.0.0, < 18.19.1 | ≥ 20.0.0, < 20.11.1 | ≥ 21.0.0, < 21.6.2
Chainguard1 product
- nodejs-16All versions (No fix recorded)
Debian1 product
- nodejs< 18.20.4+dfsg-1~deb12u1 | < 18.19.1+dfsg-1
Netapp1 product
Wolfi1 product
- nodejs-16All versions (No fix recorded)
6 vendors · 23 products
