CVE-2022-31005highCWE-190

CVE-2022-31005: high-severity vulnerability in vapor

Integer Overflow in Vapor's HTTP Range Request

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 2.1%
exploitation probability
2.1%top 19% of all CVEs
observed exploitation
nono source reports it
In short

Vapor web framework versions before 4.60.3 contain an integer overflow bug in FileMiddleware that allows attackers to crash the application by sending specially crafted HTTP range requests. This vulnerability affects any Vapor application using FileMiddleware to serve files.

Technical detail

An integer overflow in Vapor's FileMiddleware HTTP range request handler (CWE-190) allows remote attackers to trigger a denial-of-service condition by sending malformed range headers that cause arithmetic overflow during request processing. The vulnerability requires FileMiddleware to be enabled and affects versions prior to 4.60.3; exploitation results in application crash without authentication.

Summary generated and translated by AI from the official description.
Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
vapor · vapor
Related CVEs — vapor

In the same product, most dangerous first.

CVE-2021-21328MEDIUMDenial of ServiceEPSS 1.8%CVE-2022-31019HIGHDoS Vulnerability in URLEncodedFormDecoder in VaporEPSS 1.6%CVE-2020-15230HIGHArbitrary file read un VaporEPSS 1.5%CVE-2021-32742HIGHUntrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crashEPSS 1.2%CVE-2023-44386MEDIUMIncorrect request error handling triggers server crash in VaporEPSS 0.7%CVE-2024-21631MEDIUMInteger overflow in URI leading to potential host spoofingEPSS 0.6%
References
https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1https://github.com/vapor/vapor/releases/tag/4.60.3https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5