CVE-2021-41119
mediumpriority · track · 30EPSS 0.014 · 72 %ileEUUSEPSS · scored 2026-10-27
Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cs-syd.eu/posts/2021-09-11-json-vulnerabilitycnnvd
- https://cxsecurity.com/cveshow/CVE-2021-41119/cnnvd
- https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2rcnnvd
- https://cs-syd.eu/posts/2021-09-11-json-vulnerabilityenisa_euvd
- https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2renisa_euvd
- https://cs-syd.eu/posts/2021-09-11-json-vulnerabilityExploitThird Party Advisorynvd
- https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2rThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan