CVE-2021-21293: Uncontrolled Resource Consumption

February 2, 2021 (updated October 25, 2022)

Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue.

References

nvd.nist.gov/vuln/detail/CVE-2021-21293

Detect and mitigate CVE-2021-21293 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →