Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2024-45590 EUVD-2024-2860GHSA-qwcr-r2fm-qrc7

body-parser vulnerable to denial of service when url encoding is enabled

Published Sep 10, 2024 · Updated Sep 10, 2024 · Assigned by GitHub_M

Vendor: expressjs Product: body-parser Package: argo-workflows Package: body-parser Package: js-jquery Package: kubeflow-centraldashboard Package: kubeflow-pipelines Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-cache-deployer Package: kubeflow-pipelines-cache-deployer-compat Package: kubeflow-pipelines-frontend Package: kubeflow-pipelines-metadata-envoy-config Package: kubeflow-pipelines-metadata-writer Package: kubeflow-pipelines-metadata-writer-compat Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: node-body-parser Package: node-body-parser Package: python-tensorboard Package: reaper Package: sqlpad Package: sqlpad-compat Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu Ecosystem: Wolfi

Description

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Affected products

VendorProductAffectedFixed
expressjs body-parser < 1.20.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 node-body-parser 1.20.3+~1.19.5-1 —
Debian 13 node-body-parser 1.20.3+~1.19.5-1 —
Debian 12 node-body-parser No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS node-body-parser No fix yet —
Ubuntu 22.04 LTS node-body-parser No fix yet —
Ubuntu 20.04 LTS node-body-parser No fix yet —
Ubuntu 18.04 LTS node-body-parser No fix yet —
Ubuntu 16.04 LTS node-body-parser No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 js-jquery No fix yet —
Azure Linux 3 python-tensorboard 2.16.2-5 —
Azure Linux 2 (CBL-Mariner) js-jquery No fix yet —
Azure Linux 2 (CBL-Mariner) reaper 3.1.1-13 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling argo-workflows 3.6.5-r2 —
Wolfi rolling kubeflow-centraldashboard 1.9.0-r4 —
Wolfi rolling kubeflow-pipelines +11 2.2.0-r12 —
Wolfi rolling sqlpad +1 7.5.0-r1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm body-parser < 1.20.3 1.20.3 GHSA-qwcr-r2fm-qrc7

Advisories 7

References