7.5

CVE-2024-37890: websockets ws NULL Pointer Dereference

CVSS: 7.5v3.1HighDeferred
AliasesRHBA-2024:9549RHBA-2024:9550RHBA-2025:4932
Published 17-06-2024Last modified 02-08-2024
Open JSON

Vulnerability summary

CVE-2024-37890 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in websockets ws. EPSS estimates a 1.36% chance of exploitation in the next 30 days, higher than 71.2% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.36%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 9
MGASA-2025-0194CGA-4MJJ-VHP5-59V2CGA-5JJ7-2GQ6-8P9GCGA-6RMC-53QG-R2V4CGA-7Q9M-65RW-28J5CGA-CM39-XG6P-R3WR

Timeline

  1. 17-06-2024
    PublishedVulnerability first disclosed.
  2. 02-08-2024
    Last modifiedVulnerability information updated.

Description

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

CVSS metrics

9 scores · 8 sources · 2 versions

EPSS trend

Probability

1.36%

Chance of exploitation in the next 30 days

Percentile

71%

Versus all other CVEs

30-day change

0.00 pp

From 1.36% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard48 products
  • arangodb-3.11< 3.11.14.4-r12
  • arangodb-3.12< 3.12.9.4-r7
  • argo-workflows< 3.6.5-r2
  • gemini-cli< 0.49.0-r4
  • kibana-7< 7.17.24-r0
Redhat35 products
  • aspnetcore-runtime-6.0< 0:6.0.35-2.el9_5
  • aspnetcore-runtime-8.0< 0:8.0.10-3.el9_5 | < 0:8.0.13-2.el10_0
  • aspnetcore-runtime-dbg-8.0< 0:8.0.10-3.el9_5 | < 0:8.0.13-2.el10_0
  • aspnetcore-targeting-pack-6.0< 0:6.0.35-2.el9_5
  • aspnetcore-targeting-pack-8.0< 0:8.0.10-3.el9_5 | < 0:8.0.13-2.el10_0
Wolfi14 products
  • argo-workflows< 3.6.5-r2
  • kubeflow-centraldashboard< 1.8.0-r5
  • kubeflow-pipelines< 2.2.0-r4
  • kubeflow-pipelines-apiserver< 2.2.0-r4
  • kubeflow-pipelines-cache_server< 2.2.0-r4
Debian1 product
  • node-wsAll versions (No fix recorded) | < 8.18.0+~cs13.7.11-1
Npm1 product
  • ws≥ 2.1.0, < 5.2.4 | ≥ 6.0.0, < 6.2.3 | ≥ 7.0.0, < 7.5.10 | ≥ 8.0.0, < 8.17.1
Ubuntu1 product
  • node-wsAll versions (No fix recorded)
Websockets1 product
  • ws≥ 2.1.0, < 5.2.4 | ≥ 6.0.0, < 6.2.3 | ≥ 7.0.0, < 7.5.10 | ≥ 8.0.0, < 8.17.1

7 vendors · 101 products

References

24 links
Show all 24 references