Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2019-11289: Cloud Foundry Routing Crashes with Invalid HTTP Request
CVE-2019-11289 · published 6 years ago
Summary
Old versions of Cloud Foundry Routing do not check non-unique codes, making it possible for an attacker to create a fake request that crashes the system. This could disrupt Cloud Foundry services. Update to the latest version of Cloud Foundry Routing to fix this issue.
What to do
- Update code.cloudfoundry.org gorouter to version 0.0.0-20191101214924-b1b5c44e050f.
- Update cloudfoundry cf-deployment to version 12.8.0 or later.
- Update cloudfoundry routing-release to version 0.193.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | code.cloudfoundry.org | gorouter |
< 0.0.0-20191101214924-b1b5c44e050f Fix: upgrade to 0.0.0-20191101214924-b1b5c44e050f
|
| – | cloudfoundry | cf-deployment |
< 12.8.0 cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* |
| – | cloudfoundry | routing-release |
< 0.193.0 cpe:2.3:a:cloudfoundry:routing-release:*:*:*:*:*:*:*:* |
Original advisory text
Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce ...
Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
8.6
High
Type
CWE-20Improper Input Validation
Timeline
Published19 Nov 2019
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta