Advisory Database
  • Advisories
  • Dependency Scanning
  1. swift
  2. ›
  3. github.com/vapor/vapor
  4. ›
  5. CVE-2022-31005

CVE-2022-31005: Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware

June 7, 2023

Vapor is an HTTP web framework for Swift and middleware is a logic chain between the client and a Vapor route handler. FileMiddleware enables the serving of assets from the Public folder of a project to the client.

Vapor before 4.60.3 is vulnerable to denial of service due to an integer overflow when given invalid range headers while using FileMiddleware. This is patched in 4.60.3.

References

  • github.com/advisories/GHSA-vj2m-9f5j-mpr5
  • github.com/vapor/vapor
  • github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1
  • github.com/vapor/vapor/releases/tag/4.60.3
  • github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5
  • nvd.nist.gov/vuln/detail/CVE-2022-31005

Detect and mitigate CVE-2022-31005 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 4.60.3

Fixed versions

  • 4.60.3

Solution

Upgrade to version 4.60.3 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-190: Integer Overflow or Wraparound

Source file

swift/github.com/vapor/vapor/CVE-2022-31005.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:42 +0000.