CVE-2017-15010

mediumpriority · track · 31EPSS 0.033 · 88 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

3.28% (88th) EPSS

CVSS 5 · medium

Is it mine?

25 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedrhmap46/fh-aaa@sha256:333fe3a6104328fdf7a163e6782bdc93083f5824a71c172e1a91d8cd2ac4dc45_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/fh-appstore@sha256:ea7077344b9a93df67469b205b84297d9f148f8ede6c5275a934247bb5308cca_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/fh-mbaas@sha256:978137bd62f018ed791f8f242e4f454aa5632260b74416a697af2788f6fa55bc_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/fh-messaging@sha256:969cf2d92202354e4aca3cf2550ab7c06d1c1d9557d9498b111de792b659aba2_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/fh-metrics@sha256:4ae06c04142b0b146ca8a3da6da113d2600fd46307f501043c3a23040d89d2b0_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/fh-ngui@sha256:b5dd33fabd680944f0075f6788ac3b5263a11a542ce51e6705dc0ad94aded656_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/fh-scm@sha256:5ce3e868c6c1a8a86c1bf29ddf0e08e82827d4a39eafd8c5f36229a83f4c880b_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/fh-sdks@sha256:91c35fb5b97a5487aac0db2e45d2aa9c22b8ae2fe96e564c333b89b8c1023683_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/fh-statsd@sha256:55122c42b06eb1202e471247b8f9e1a6af1f855ebd620af74d0c338665bba603_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/fh-supercore@sha256:5400eb2ef4cf354c94c47439e5d3ef4bd355a8951463f0ccb9db40e313cb509e_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/gitlab-shell@sha256:e167f23019582aaca1791ba5f8c26825ea62d9885f6a06362f0a6648137381c7_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/httpd@sha256:338594491055c702411209edb55673d5718285fbf8e6d9241d8963ba929c3754_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/installer@sha256:940137b25079909c06b724d838a48db58a98d49baf3cb9eee0e0a068deba44bb_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/memcached@sha256:65d5a737ae9380a7a041726a33c0b36e4065ec9ea6890d327034f03bb1ce0969_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/millicore@sha256:babc8754be2c766a22461ce88b22fe18d17da84091e0dc4dd9e0edba8199e8f5_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/mongodb@sha256:bcfd94b74bfb049fc6c5649216d703f15fe22c2caf30121ade844760fdefc601_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/mysql@sha256:e95585839f27c671609e0bafdb0c3e6752b114882b25b1b35d817142e738a597_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/nagios@sha256:321690d3b24c6281ee7b3bee9b7388676b96b5f3f2a6841bedc872614d73ecd8_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/redis@sha256:752ce940961048a174863aef559c8e303387f67bdbdbe1d91b197c9bbe7f773a_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/ups-eap@sha256:22ef1c2136573a99f278d5f1b384ee35244382a92a3ea2190e74d8ad660f009c_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Fixedrhmap46/wildcard-proxy@sha256:5abb752987bde3c20273f9b19266bd8ba2015a06336980f8cf02e3a1f969dbf8_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.06.9mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · Red Hat Product Security US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400USprimaryCWE-400USCWE-400US

affected products (25)

Products and version ranges known to be affected.

showing 20 of 25

advisories (3)

Vendor and ecosystem advisories describing this.

RHSA-2018:1264Red Hat Security Advisory: Red Hat Mobile Application Platform 4.6.0 Release - Container Images2018-04-30csaf · redhat_csafUS
Red Hat Mobile Application Platform 4.6.0 Release - Container Images
WID-SEC-W-2024-1591Juniper JUNOS: Mehrere SchwachstellenDeutsch2024-07-10csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive zu umgehen.
GHSA-g7q5-pjjr-gqvpRegular Expression Denial of Service in tough-cookie2018-07-24ghsa · osvUS
Affected versions of `tough-cookie` are susceptible to a regular expression denial of service. The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length. If node was compiled using the `-DHTTP_MAX_HEADER_SIZE` however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node. ## Recommendation Update to version 2.3.3 or later.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv redhat_csaf NVD CVE.org MITRE

published 2017-10-04modified 2026-06-17

related (9,612)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-28318US	—OT critical	43.7% (99th)	KEV	2026-06-04
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provi…
CVE-2026-45498US	high7.5OT critical	63.1% (99th)	KEV	2026-05-20
Microsoft Defender Denial of Service Vulnerability
CVE-2023-44487US	high7.5OT critical	100.0% (100th)	KEV	2023-10-10
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through…
CVE-2023-38180US	—OT critical	14.1% (97th)	KEV	2023-08-08
.NET and Visual Studio Denial of Service Vulnerability
CVE-2021-44228US	critical10.0OT critical	100.0% (100th)	KEV	2021-12-10
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect agai…

+9607 more

references (27)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan