CVE-2022-31005CWE-190

Integer Overflow in Vapor's HTTP Range Request

High · published May 31, 2022

CVSS v3.1
7.5
EPSS
2%
Percentile
81.6
In the wild
Unconfirmed
What it is

Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02108 · 81.6th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2022-05-31T19:35Z
EPSS history
Timeline
  • 31 MAY 19:35Z
    Integer Overflow in Vapor's HTTP Range Request
    cvelistv5