Medium severity · published Sep 5, 2018
CVE-2016-1000232
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service
5.3
CVSS
2.4%
EPSS
No
On KEV
Description
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Api Connect · Ibm
5.0.6.0 through 5.0.6.5; 5.0.7.0 through 5.0.7.2; 5.0.8.0 · source: NVD
OC
Openshift Container Platform · Redhat
3.1; 3.2; 3.3 · source: NVD
TO
Tough-cookie · Salesforce
0.9.7 through 2.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-1000232
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-1000232
Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:2101
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2912
Third Party Advisory
https://access.redhat.com/security/cve/cve-2016-1000232
Patch
https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae
Patch
https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534
Third Party Advisory
https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232/
More from Api Connect
10.0
CVE-2019-4202
IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection
9.9
CVE-2018-1789
IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack
9.9
CVE-2018-1712
IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery
9.8
CVE-2026-9074
IBM API Connect SQL Injection
9.8
CVE-2026-3144
IBM API Connect Default Credentials