Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.2%
exploitation probability
1.2%top 35% of all CVEs
observed exploitation
nono source reports it
In short
A flaw in Vapor's base32 decoding function can expose server memory or crash the application when processing untrusted data. This affects apps that use this specific function directly or through dependencies.
Technical detail
CWE-502 (Deserialization of Untrusted Data): The `Data.init(base32Encoded:)` function in Vapor ≤4.47.1 improperly handles base32-encoded input, allowing an attacker to supply malicious data that triggers memory disclosure or denial of service. Exploitation requires the vulnerable function to process attacker-controlled input.
Summary generated and translated by AI from the official description.
Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial of Service) for applications where untrusted data can end up in said function. Vapor does not currently use this function itself so this only impact applications that use the impacted function directly or through other dependencies. The vulnerability is patched in version 4.47.2. As a workaround, one may use an alternative to Vapor's built-in `Data.init(base32Encoded:)`.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
vapor · vapor