CVE-2023-44386mediumCWE-231CWE-617CWE-696

CVE-2023-44386: medium-severity vulnerability in vapor

Incorrect request error handling triggers server crash in Vapor

Published · Updated

Follow this CVE+ Monitor vapor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.7%
In short

Vapor, a web framework for Swift, crashes when it receives malformed HTTP requests because it closes connections instead of handling errors properly. This allows attackers to take down the service by sending bad requests.

Technical detail

A denial of service vulnerability in Vapor's HTTP/1 error handler allows unauthenticated remote attackers to crash the server by sending malformed HTTP requests. The framework closes connections on HTTP parse errors instead of gracefully handling them, requiring no special privileges or user interaction. Fixed in Vapor 4.84.2.

Summary generated and translated by AI from the official description.
Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
vapor · vapor
Related CVEs — vapor

In the same product, most dangerous first.

CVE-2022-31005HIGHInteger Overflow in Vapor's HTTP Range RequestEPSS 2.1%CVE-2021-21328MEDIUMDenial of ServiceEPSS 1.8%CVE-2022-31019HIGHDoS Vulnerability in URLEncodedFormDecoder in VaporEPSS 1.7%CVE-2020-15230HIGHArbitrary file read un VaporEPSS 1.5%CVE-2021-32742HIGHUntrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crashEPSS 1.2%CVE-2024-21631MEDIUMInteger overflow in URI leading to potential host spoofingEPSS 0.6%