Back to Database
Status published
High
CVE-2020-15694
In Nim 1.2.4, the standard library httpClient fails to properly...
Vulnerability Description
In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any error if a malicious server provides a negative Content-Length.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15694
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/httpclient.nim#L241
- https://nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html
- http://www.openwall.com/lists/oss-security/2021/02/04/2
- https://consensys.net/diligence/vulnerabilities/nim-httpclient-header-crlf-injection/
More from nim-lang
View All →CVE-2022-23602
Nim's rst parser sandboxed mode allows include which can embed any local file
High
7.7
CVE-2021-46872
An issue was discovered in Nim before 1.6.2. The RST...
Unknown
0
CVE-2021-29495
Nim stdlib httpClient does not validate peer certificates by default
Medium
5.9
CVE-2021-21374
Nimble fails to validate certificates due to insecure httpClient defaults
High
8.1
CVE-2021-21373
Nimble falls back to insecure http url when fetching packages
High
7.5
Affected Vendor
nim-lang
View all reports →Affected Software
nim
Vulnerable Versions:
0
Timeline
Official Publish:
August 14th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.