CVE-2021-42717 - CVE House
Back to Database
Status published High CVE-2021-42717

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted...

Vulnerability Description

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-42717

Credits & Attribution

No credits recorded in the NVD database.

References

More from owasp

View All →
CVE-2022-48279
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart...
Unknown 0
CVE-2022-27820
OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify...
Medium 4
CVE-2021-42575
The OWASP Java HTML Sanitizer before 20211018.1 does not properly...
Critical 9.8
CVE-2021-35368
OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before...
Critical 9.8
CVE-2021-28490
In OWASP CSRFGuard through 3.1.0, CSRF can occur because the...
High 8.8

Affected Vendor

Affected Software

modsecurity, nginx modsecurity waf, debian linux, http server, zfs storage appliance kit
Vulnerable Versions:
3.0.0, 2.0.0, r24, r25, 9.0, 10.0, 11.0, 12.2.1.3.0, 12.2.1.4.0, 8.8

Timeline

Official Publish: December 7th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.