CVE-2022-31005
published 2022-05-31CVE-2022-31005: Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.89%
77.0th percentile
Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | vapor_vapor | >= 0 < 4.60.3 | 4.60.3 |
| vapor | vapor | < 4.60.3 | 4.60.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware
osv·2023-06-07
CVE-2022-31005 [HIGH] Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware
Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware
Vapor is an HTTP web framework for Swift and [middleware](https://docs.vapor.codes/advanced/middleware/) is a logic chain between the client and a Vapor route handler. [FileMiddleware](https://docs.vapor.codes/advanced/middleware/#file-middleware) enables the serving of assets from the Public folder of a project to the client.
Vapor before 4.60.3 is vulnerable to denial of service due to an integer overflow when given invalid range headers while using FileMiddleware. This is patched in 4.60.3.
GHSA
Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware
ghsa·2023-06-07
CVE-2022-31005 [HIGH] CWE-190 Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware
Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware
Vapor is an HTTP web framework for Swift and [middleware](https://docs.vapor.codes/advanced/middleware/) is a logic chain between the client and a Vapor route handler. [FileMiddleware](https://docs.vapor.codes/advanced/middleware/#file-middleware) enables the serving of assets from the Public folder of a project to the client.
Vapor before 4.60.3 is vulnerable to denial of service due to an integer overflow when given invalid range headers while using FileMiddleware. This is patched in 4.60.3.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1https://github.com/vapor/vapor/releases/tag/4.60.3https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1https://github.com/vapor/vapor/releases/tag/4.60.3https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5
2022-05-31
Published