CVE-2021-21328mediumCWE-400

CVE-2021-21328: medium-severity vulnerability in vapor

Denial of Service

Published · Updated

Follow this CVE+ Monitor vapor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 1.8%
In short

Vapor web framework versions before 4.40.1 are vulnerable to denial-of-service attacks where sending requests to many different URLs can create unlimited counters and timers, draining system resources and affecting the application and connected services.

Technical detail

CWE-400 resource exhaustion vulnerability in Vapor's metrics backend: unauthenticated attackers can trigger unlimited counter/timer creation by sending requests to arbitrary undefined routes, consuming memory and processing resources. Patched by rewriting undefined routes to a single `vapor_route_undefined` counter. Affects any Vapor instance with metrics enabled pre-4.40.1.

Summary generated and translated by AI from the official description.
Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
vapor · vapor
Related CVEs — vapor

In the same product, most dangerous first.

CVE-2022-31005HIGHInteger Overflow in Vapor's HTTP Range RequestEPSS 2.1%CVE-2022-31019HIGHDoS Vulnerability in URLEncodedFormDecoder in VaporEPSS 1.7%CVE-2020-15230HIGHArbitrary file read un VaporEPSS 1.5%CVE-2021-32742HIGHUntrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crashEPSS 1.2%CVE-2023-44386MEDIUMIncorrect request error handling triggers server crash in VaporEPSS 0.7%CVE-2024-21631MEDIUMInteger overflow in URI leading to potential host spoofingEPSS 0.6%