CVE-2021-41119

Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.

• CWE-400
• CWE-400

• https://cs-syd.eu/posts/2021-09-11-json-vulnerabilityExploit, Third Party Advisory
• https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2rThird Party Advisory
• https://cs-syd.eu/posts/2021-09-11-json-vulnerabilityExploit, Third Party Advisory
• https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2rThird Party Advisory

Published

Apr 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41113TYPO3 is an open source PHP based web content management sys…8.8
• CVE-2021-41114TYPO3 is an open source PHP based web content management sys…5.3
• CVE-2021-41115Zulip is an open source team chat server. In affected versio…6.5
• CVE-2021-41116Composer is an open source dependency manager for the PHP la…9.8
• CVE-2021-41117keypair is a a RSA PEM key generator written in javascript. …9.1
• CVE-2021-41118The DynamicPageList3 extension is a reporting tool for Media…7.5
• CVE-2021-4112A flaw was found in ansible-tower where the default installa…8.8
• CVE-2021-41120sylius/paypal-plugin is a paypal plugin for the Sylius devel…7.5
• CVE-2021-41121Vyper is a Pythonic Smart Contract Language for the EVM. In …8.8
• CVE-2021-41122Vyper is a Pythonic Smart Contract Language for the EVM. In …4.3
• CVE-2021-41123Survey Solutions is a survey management and data collection …5.3
• CVE-2021-41124Scrapy-splash is a library which provides Scrapy and JavaScr…7.5