CVE-2024-21631 Integer overflow in URI leading to potential host spoofing

Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor's vaporurlparserparse function uses uint16t indexes when parsing a URI's components, which may cause integer overflows when parsing untrusted inputs. This vulnerability does not affect Vapor directly but could impact...

CVE-2024-21631

CVE-2024-21631 : Vapor’s vapor_urlparser_parse uses 16‑bit indices when parsing URI components, which may overflow for untrusted inputs and enable host spoofing in affected apps that use Vapor’s URI type. This affects versions prior to 4.90.0; 4.90.0 contains a patch. Workarounds include validati...