Incorrect request error handling triggers server crash in Vapor
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.6%
exploitation probability
0.6%top 55% of all CVEs
observed exploitation
nono source reports it
In short
Vapor, a web framework for Swift, crashes when it receives malformed HTTP requests because it closes connections instead of handling errors properly. This allows attackers to take down the service by sending bad requests.
Technical detail
A denial of service vulnerability in Vapor's HTTP/1 error handler allows unauthenticated remote attackers to crash the server by sending malformed HTTP requests. The framework closes connections on HTTP parse errors instead of gracefully handling them, requiring no special privileges or user interaction. Fixed in Vapor 4.84.2.
Summary generated and translated by AI from the official description.
Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
vapor · vapor