CVE-2022-24863CWE-400

Denial of service in http-swagger

High · published April 18, 2022

CVSS v3.1
7.5
EPSS
2%
Percentile
84.2
In the wild
Unconfirmed
What it is

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02440 · 84.2th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2022-04-18T19:00Z
EPSS history
Timeline
  • 18 APR 19:00Z
    Denial of service in http-swagger
    cvelistv5