CVE-2021-27191

HIGH

get-ip-range < 4.0.0 - Denial of Service via Large IP Range Input

Title source: llm
STIX 2.1

Description

The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion.

References (4)

Core 4
Core References
Product, Third Party Advisory x_refsource_misc
https://www.npmjs.com/package/get-ip-range
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210319-0002/
Exploit, Third Party Advisory x_refsource_misc
https://advisory.checkmarx.net/advisory/CX-2021-4304

Scores

CVSS v3 7.5
EPSS 0.0203
EPSS Percentile 78.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

Status published
Products (2)
get-ip-range_project/get-ip-range < 4.0.0
npm/get-ip-range 0 - 4.0.0npm
Published Feb 11, 2021
Tracked Since Feb 18, 2026