Resource exhaustion in Mintty Project
CVE-2021-28848
Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window to change its title repeatedly at high speed, which results in many SetWindowTextA or SetWindowTextW calls. In other words, it does not implement a usleep or similar delay upon processing a title change.
EPSS: 0.016 (73.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Mintty_project Mintty
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-28848?
- CVE-2021-28848 is a high-severity vulnerability in Mintty Project, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2021-06-03.
- How severe is CVE-2021-28848?
- High severity. CVSS v3 base score is 7.5 out of 10.