Junglewise Threat Intelligence

CVE-2010-3198: Zope ZServer denial of service via worker thread crash

CVE-2010-3198 · Severity: high · CVSS 7.5 · Published 2022-05-17

Technologies: Zope (PyPI). Vendors: PyPI.

Executive brief

A vulnerability in the ZServer component of the Zope web application server allows remote attackers to crash the server's worker threads. By sending specifically crafted web requests that trigger unhandled errors, an attacker can exhaust the server's processing capacity. This results in a denial of service where the application remains running but becomes unresponsive to legitimate users.

Technical details

The ZServer component in Zope versions 2.10.x (before 2.10.12) and 2.11.x (before 2.11.7) lacks a global exception handler for its worker threads. An unauthenticated remote attacker can exploit this by sending requests that trigger uncaught exceptions—for example, by providing malformed list parameters to certain authentication plugins like CookieAuthHelper. When an exception occurs during publication and is not caught, the individual worker thread terminates. By repeating this process, an attacker can kill all available worker threads, leading to a complete denial of service. The issue was resolved by backporting a catch-all exception handler from Zope 2.12.

Affected products

  • Zope Foundation Zope >= 2.10.0, < 2.10.12; >= 2.11.0, < 2.11.7

Timeline

  • 2010-09-01: patched: Fixes committed to 2.10 and 2.11 branches and releases announced.
  • 2010-09-08: advisory: NVD published CVE-2010-3198.
  • 2022-05-17: advisory: GitHub Advisory published.

References

Related threats