110 matches found
CVE-2026-43678
An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...
CVE-2026-43678
An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...
CVE-2026-43678
CVE-2026-43678 is a Denial of Service vulnerability in swift-nio 's NIOWebSocket component. An unauthenticated remote attacker can crash any NIOWebSocket-based server—including the Vapor and Hummingbird frameworks—by sending a single 11-byte frame after a completed WebSocket handshake. This drops...
CVE-2026-43678
An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...
GHSA-RJ37-6J9X-74Q6 SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS
Summary The HTTPDecoder in NIOHTTP1 enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fields per message. A remote peer can submit an arbitrary number of small, valid headers in a single request and have them all accumulated into the resulting...
SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec
swift-nio-http2's HTTP/2-to-HTTP/1.1 codec HTTP2FramePayloadToHTTP1ServerCodec / HTTP2ToHTTP1ServerCodec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. A remote attacker could send an HTTP/2 request containing CR \r, LF \n, o...
Improper Encoding or Escaping of Output
Overview vapor/leaf-kit is an an expressive, performant, and extensible templating language built for Swift. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the htmlEscaped process. An attacker can inject and execute arbitrary scripts in the context ...
leafkit 安全漏洞
Leafkit is an open-source application developed by Vapor. It uses Swift to create modular server-side software. Versions of Leafkit prior to 1.4.1 contained security vulnerabilities. These vulnerabilities stemmed from the fact that htmlEscaped only matched extended character clusters, which could...
EUVD-2023-1801
Malicious code in bioql PyPI...
EUVD-2023-2631
Malicious code in bioql PyPI...
EUVD-2023-1872
Malicious code in bioql PyPI...
EUVD-2023-1891
Malicious code in bioql PyPI...
EUVD-2024-0412
Malicious code in bioql PyPI...
EUVD-2023-1859
Malicious code in bioql PyPI...
EUVD-2023-1889
Malicious code in bioql PyPI...
Malicious code in @malware-test-vapor-masty-zeros-matte/test-mlw3-vapor-masty-zeros-matte (npm)
The package @malware-test-vapor-masty-zeros-matte/test-mlw3-vapor-masty-zeros-matte was found to contain malicious code...
MAL-2025-8801 Malicious code in @malware-test-musty-meats-dated-vapor/test-mlw3-musty-meats-dated-vapor (npm)
The package @malware-test-musty-meats-dated-vapor/test-mlw3-musty-meats-dated-vapor was found to contain malicious code...
MAL-2025-9047 Malicious code in @malware-test-vapor-masty-zeros-matte/test-mlw3-vapor-masty-zeros-matte (npm)
The package @malware-test-vapor-masty-zeros-matte/test-mlw3-vapor-masty-zeros-matte was found to contain malicious code...
Malicious code in @malware-test-musty-meats-dated-vapor/test-mlw3-musty-meats-dated-vapor (npm)
The package @malware-test-musty-meats-dated-vapor/test-mlw3-musty-meats-dated-vapor was found to contain malicious code...
CVE-2024-21631
Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor's vaporurlparserparse function uses uint16t indexes when parsing a URI's components, which may cause integer overflows when parsing untrusted inputs. This vulnerability does not affect Vapor directly but could impact...