VulnerabilityModified
CVE-2021-33175
EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted inputs.
HIGH 7.5EPSS 1.10%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.10%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted inputs. These inputs cause the message broker to consume large amounts of memory, resulting in the application being terminated by the operating system.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.10% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502, CWE-770
- Affected
- emqx/emq x broker
- Source
- disclosure@synopsys.com
References
- https://www.synopsys.com/blogs/software-security/cyrc-advisory-rabbitmq-emqx-vernemqPatch, Third Party Advisory
- https://www.synopsys.com/blogs/software-security/cyrc-advisory-rabbitmq-emqx-vernemqPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.