What is the CVSS score of CVE-2021-41167?

CVE-2021-41167 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.6%.

Is there a public PoC exploit available for CVE-2021-41167?

Yes, a public proof-of-concept exploit is available for CVE-2021-41167. Prioritise patching immediately. EPSS: 1.6%.

Is there a patch available for CVE-2021-41167?

Yes, a patch is available for CVE-2021-41167. Update the affected software to the latest version immediately.

Modern Async CVE-2021-41167

HIGH

Uncontrolled Resource Consumption (CWE-400)

2021-10-20 security-advisories@github.com

Denial Of Service Modern Async

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Oct 20, 2021 - 19:15 cve.org

HIGH 7.5

DescriptionCVE.org

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.

AnalysisAI

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround. Affected products include: Modern-Async Project Modern-Async.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.