CVE-2022-24863 Denial of service in http-swagger

2022-04-1819:00:22

CWE-400

GitHub_M

www.cve.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

53.2%

JSON

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the “GET” method as a workaround.

CNA Affected

[
  {
    "product": "http-swagger",
    "vendor": "swaggo",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.2.6"
      }
    ]
  }
]