CVE-2021-41119 - CVE House
Back to Database
Status published Medium CVE-2021-41119

DoS vulnerabiliity in wire-server json parser

Vulnerability Description

Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41119

Credits & Attribution

No credits recorded in the NVD database.

References

More from wireapp

View All →
CVE-2025-49846
wire-ios accidentally logs message contents
Medium 4.1
CVE-2025-48066
wire-webapp has no database deletion on client logout
Medium 6
CVE-2025-48061
wire-webapp Has Insufficient Session Invalidation after User Logout
Medium 5.6
CVE-2023-48221
wire-avs remote format string vulnerability
High 7.3
CVE-2023-22737
wire-server vulnerable to unauthorized removal of Bots from Conversations
Medium 6.5

Affected Vendor

Affected Software

wire-server
Vulnerable Versions:
< v2022-03-01

Timeline

Official Publish: April 13th, 2022
Last Modified: April 22nd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact