wire-server vulnerabilities

Latest wire-server CVEs

Newest publication first

1. CVE-2021-41119 DoS vulnerabiliity in wire-server json parser

   Published 2022-04-13

   High·CVSS 7.5

   Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a...

2. CVE-2022-23610 Improper Verification of Cryptographic Signature in wire-server

   Published 2022-03-16

   High·CVSS 8.1

   wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to bypass SAML SSO and impersonate any Wire user with SAML credentials. In teams with SAML, but without S...

3. CVE-2021-41100 Account takeover when having only access to a user's short lived token in wire-server

   Published 2021-10-04

   Critical·CVSS 9.8

   Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger email address change of a user with only the short-lived session token in the Authorization header. As the short-lived token is only meant as me...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.