body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Fri, 06 Jun 2025 21:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.14::el9
cpe:/a:redhat:openshift_data_foundation:4.15::el9

Thu, 20 Mar 2025 15:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhdh:1.3::el9

Fri, 14 Feb 2025 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhdh
CPEs cpe:/a:redhat:rhdh:1.4::el9
Vendors & Products Redhat rhdh

Thu, 13 Feb 2025 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat discovery
Redhat openshift
CPEs cpe:/a:redhat:openshift:4.17::el9
cpe:/o:redhat:discovery:1.0::el9
Vendors & Products Redhat discovery
Redhat openshift

Thu, 12 Dec 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Distributed Tracing
CPEs cpe:/a:redhat:openshift_distributed_tracing:3.4::el8
Vendors & Products Redhat openshift Distributed Tracing

Tue, 10 Dec 2024 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhmt
CPEs cpe:/a:redhat:rhmt:1.8::el8
Vendors & Products Redhat rhmt

Mon, 02 Dec 2024 02:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:advanced_cluster_security:4.5::el8

Fri, 22 Nov 2024 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat trusted Profile Analyzer
CPEs cpe:/a:redhat:trusted_profile_analyzer:1.2::el9
Vendors & Products Redhat trusted Profile Analyzer

Thu, 14 Nov 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Security
CPEs cpe:/a:redhat:advanced_cluster_security:4.4::el8
Vendors & Products Redhat advanced Cluster Security

Thu, 31 Oct 2024 02:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.17::el9
cpe:/a:redhat:openshift_gitops:1.12::el8
cpe:/a:redhat:openshift_gitops:1.12::el9

Wed, 30 Oct 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Gitops
CPEs cpe:/a:redhat:openshift_gitops:1.13::el8
Vendors & Products Redhat openshift Gitops

Tue, 22 Oct 2024 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat network Observ Optr
CPEs cpe:/a:redhat:network_observ_optr:1.7.0::el9
Vendors & Products Redhat network Observ Optr

Wed, 16 Oct 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Data Foundation
CPEs cpe:/a:redhat:openshift_data_foundation:4.16::el9
Vendors & Products Redhat openshift Data Foundation

Tue, 08 Oct 2024 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat service Mesh
CPEs cpe:/a:redhat:service_mesh:2.5::el8
cpe:/a:redhat:service_mesh:2.6::el8
cpe:/a:redhat:service_mesh:2.6::el9
Vendors & Products Redhat
Redhat service Mesh

Fri, 20 Sep 2024 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Openjsf
Openjsf body-parser
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:openjsf:body-parser:*:*:*:*:*:node.js:*:*
Vendors & Products Openjsf
Openjsf body-parser

Tue, 10 Sep 2024 21:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Important


Tue, 10 Sep 2024 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Expressjs
Expressjs body-parser
CPEs cpe:2.3:a:expressjs:body-parser:*:*:*:*:*:*:*:*
Vendors & Products Expressjs
Expressjs body-parser
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 10 Sep 2024 16:15:00 +0000

Type Values Removed Values Added
Description body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.
Title body-parser vulnerable to denial of service when url encoding is enabled
Weaknesses CWE-405
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2024-09-10T18:47:22.965Z

Reserved: 2024-09-02T16:00:02.422Z

Link: CVE-2024-45590

cve-icon Vulnrichment

Updated: 2024-09-10T18:45:10.928Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-10T16:15:21.083

Modified: 2024-09-20T16:26:44.977

Link: CVE-2024-45590

cve-icon Redhat

Severity : Important

Publid Date: 2024-09-10T16:15:21Z

Links: CVE-2024-45590 - Bugzilla

cve-icon OpenCVE Enrichment

No data.