CVE-2023-44386 Incorrect request error handling triggers server crash in Vapor

2023-10-0517:41:38

CWE-696

CWE-231

CWE-617

GitHub_M

www.cve.org

cve-2023-44386

http web framework

swift

vapor

denial of service

vulnerability

http parse error

fix

release 4.84.2

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.001

Percentile

27.3%

JSON

Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.

CNA Affected

[
  {
    "vendor": "vapor",
    "product": "vapor",
    "versions": [
      {
        "version": ">= 4.83.2, < 4.84.2",
        "status": "affected"
      }
    ]
  }
]