Vulnerability · Published May 31, 2022 · Assigned by GitHub_M
CVE-2022-31005Integer Overflow in Vapor's HTTP Range Request
High 7.5
In plain English
A high-severity integer overflow in vapor from vapor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.1%top 18.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5 x_refsource_CONFIRM
- https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1 x_refsource_MISC
- https://github.com/vapor/vapor/releases/tag/4.60.3 x_refsource_MISC