Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/54536?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54536?format=api", "vulnerability_id": "VCID-q35m-3hvy-a7dx", "summary": "Uncontrolled Resource Consumption\nws is an open source WebSocket client and server library for Node. In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers.", "aliases": [ { "alias": "CVE-2021-32640" }, { "alias": "GHSA-6fc8-4gx4-v693" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/119230?format=api", "purl": "pkg:deb/debian/node-ws@7.4.2%2B~cs18.0.8-2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-72v3-t5vr-w7hx" }, { "vulnerability": "VCID-bqh9-yun3-vfch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/node-ws@7.4.2%252B~cs18.0.8-2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/119228?format=api", "purl": "pkg:deb/debian/node-ws@8.11.0%2B~cs13.7.3-1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-72v3-t5vr-w7hx" }, { "vulnerability": "VCID-bqh9-yun3-vfch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/node-ws@8.11.0%252B~cs13.7.3-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/119232?format=api", "purl": "pkg:deb/debian/node-ws@8.18.1%2B~cs14.18.2-1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bqh9-yun3-vfch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/node-ws@8.18.1%252B~cs14.18.2-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/119231?format=api", "purl": "pkg:deb/debian/node-ws@8.20.1%2B~cs14.19.1-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/node-ws@8.20.1%252B~cs14.19.1-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/142879?format=api", "purl": "pkg:npm/ws@5.2.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/ws@5.2.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/80845?format=api", "purl": "pkg:npm/ws@6.2.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/ws@6.2.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/80846?format=api", "purl": "pkg:npm/ws@7.4.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/ws@7.4.6" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/80843?format=api", "purl": "pkg:npm/ws@5.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-q35m-3hvy-a7dx" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/ws@5.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/80844?format=api", "purl": "pkg:npm/ws@7.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-72v3-t5vr-w7hx" }, { "vulnerability": "VCID-q35m-3hvy-a7dx" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/ws@7.0.0" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-32640.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-32640.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-32640", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01154", "scoring_system": "epss", "scoring_elements": "0.78867", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-32640" }, { "reference_url": "https://github.com/websockets/ws", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/websockets/ws" }, { "reference_url": "https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff" }, { "reference_url": "https://github.com/websockets/ws/issues/1895", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/websockets/ws/issues/1895" }, { "reference_url": "https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693" }, { "reference_url": "https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30@%3Ccommits.tinkerpop.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/rdfa7b6253c4d6271e31566ecd5f30b7ce1b8fb2c89d52b8c4e0f4e30@%3Ccommits.tinkerpop.apache.org%3E" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210706-0005", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210706-0005" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1965488", "reference_id": "1965488", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1965488" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32640", "reference_id": "CVE-2021-32640", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32640" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 400, "name": "Uncontrolled Resource Consumption", "description": "The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 345, "name": "Insufficient Verification of Data Authenticity", "description": "The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-q35m-3hvy-a7dx" }