Moleculer TCP transporter packet parser infinite loop stalls services
If the microservice framework's communication port is open, anyone can stop your services.
Summary
A malformed length value sent to the TCP transporter's packet parser in the Moleculer Node.js microservices framework sends the parser into an endless loop, which stops every service in the process until restart. A remote peer can trigger it without authentication.
Affected when
- TCP transporter enabled and reachable
What to do
Update to 0.14.36 or 0.15.2 or later. CRC validation and maxPacketSize do not prevent it.
Update to at least the version for your product:
- Moleculer 0.14 0.14.36 or later
- Moleculer 0.15 0.15.2 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen