CVE-2021-32742highCWE-502

CVE-2021-32742: high-severity vulnerability in vapor

Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash

Published · Updated

Follow this CVE+ Monitor vapor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.2%
In short

A flaw in Vapor's base32 decoding function can expose server memory or crash the application when processing untrusted data. This affects apps that use this specific function directly or through dependencies.

Technical detail

CWE-502 (Deserialization of Untrusted Data): The `Data.init(base32Encoded:)` function in Vapor ≤4.47.1 improperly handles base32-encoded input, allowing an attacker to supply malicious data that triggers memory disclosure or denial of service. Exploitation requires the vulnerable function to process attacker-controlled input.

Summary generated and translated by AI from the official description.
Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial of Service) for applications where untrusted data can end up in said function. Vapor does not currently use this function itself so this only impact applications that use the impacted function directly or through other dependencies. The vulnerability is patched in version 4.47.2. As a workaround, one may use an alternative to Vapor's built-in `Data.init(base32Encoded:)`.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
vapor · vapor
Related CVEs — vapor

In the same product, most dangerous first.

CVE-2022-31005HIGHInteger Overflow in Vapor's HTTP Range RequestEPSS 2.1%CVE-2021-21328MEDIUMDenial of ServiceEPSS 1.8%CVE-2022-31019HIGHDoS Vulnerability in URLEncodedFormDecoder in VaporEPSS 1.7%CVE-2020-15230HIGHArbitrary file read un VaporEPSS 1.5%CVE-2023-44386MEDIUMIncorrect request error handling triggers server crash in VaporEPSS 0.7%CVE-2024-21631MEDIUMInteger overflow in URI leading to potential host spoofingEPSS 0.6%