GitHub Advisoryadvisory · npm

GHSA-6375-pg5j-8wph Denial of service in rocket chat message parser

MEDIUM Published 2024-09-25 Modified 2024-09-26 Official page ↗
Aliases
CVE-2024-46935
Ecosystem
npm
Packages
@rocket.chat/message-parser
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2024-09-25

Affected packages

• npm @rocket.chat/message-parser: < 0.31.30 → fixed in 0.31.30

Description

Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). Attackers who craft messages with specific characters may crash the workspace due to an issue in the message parser.

Related

Alias · CVE (1)

  • CVE-2024-46935 Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References