{"id":"CVE-2021-41119","aliases":["EUVD-2021-28250","GHSA-phxv-pffh-fq2r","UBUNTU-CVE-2021-41119"],"status":"published","title":"DoS vulnerabiliity in wire-server json parser","description":"Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01361,"percentile":0.72151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2022-04-13T18:25:11Z","modified":"2026-10-20T10:54:57Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"haskell-aeson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0.2-3","0.8.0.2-5","0.10.0.0-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"haskell-aeson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2.1-6build1","1.1.2.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"haskell-aeson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2.0-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"haskell-aeson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.7.1-2build2"]}],"products":[{"vendor":"wire","product":"wire-server"},{"vendor":"wireapp","product":"wire-server"}],"references":[{"url":"https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://cs-syd.eu/posts/2021-09-11-json-vulnerability","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://ubuntu.com/security/CVE-2021-41119","tags":["report"]},{"url":"https://github.com/haskell/aeson/issues/864","tags":["report"]},{"url":"https://hackage.haskell.org/package/aeson-2.0.1.0","tags":["report"]},{"url":"https://github.com/haskell/aeson/commit/582a844d8028f62e409048a4caae187b27e8e697","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41119","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-41119","title":"DoS vulnerabiliity in wire-server json parser","description":"Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.","status":"published","published":"2022-04-13T18:25:11Z","modified":"2025-04-22T18:16:06.159Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-28250","description":"Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.","status":"published","published":"2022-04-13T18:25:11Z","modified":"2025-04-22T18:16:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:15.026784Z"}],"nvd":[{"id":"CVE-2021-41119","description":"Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.","status":"published","published":"2022-04-13T19:15:08.99Z","modified":"2026-06-17T04:07:54.6Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:06.029737Z"}],"osv":[{"id":"CVE-2021-41119","description":"Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.","status":"published","published":"2022-04-13T19:15:08.99Z","modified":"2026-10-20T10:54:57.415473343Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"UBUNTU-CVE-2021-41119","description":"Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.","status":"published","published":"2022-04-13T19:15:00Z","modified":"2026-04-22T13:00:59.394431Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"}]}}