CVE-2019-5645

CVE-2019-5645 is a denial-of-service vulnerability affecting Rapid7 Metasploit. An unauthenticated attacker can send a specially crafted HTTP GET request to a Metasploit HTTP handler, registering a malicious regular expression. This can lead to resource exhaustion on the Metasploit server or prevent new HTTP handler sessions, resulting in a denial of service. With a CVSS score of 7.5 (High), this vulnerability is easily exploitable over the network with low attack complexity, impacting availability. While not listed in CISA's KEV catalog, a Metasploit auxiliary module exists for exploitation, though there is no evidence of active exploitation or significant community discussion.