Description

The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

Remediation

References

https://github.com/eclipse/milo/issues/1030

https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5

https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191

https://github.com/eclipse/milo/pull/1031

Related Vulnerabilities

CVE-2018-1304 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2014-6071 Vulnerability in npm package jquery

CVE-2021-35513 Vulnerability in maven package org.webjars.bower:mermaid

CVE-2023-32262 Vulnerability in maven package org.jenkins-ci.plugins:dimensionsscm

CVE-2023-50481 Vulnerability in npm package blinksocks

Severity

High

Classification

CWE-770 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Issue Tracking Patch Third Party Advisory