CVE-2023-44386CWE-231CWE-617CWE-696

Incorrect request error handling triggers server crash in Vapor

Medium · published October 5, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00736 · 54.0th percentile
Weaknesses
CWE-231 · Improper Handling of Extra Values; CWE-617 · Reachable Assertion; CWE-696 · Incorrect Behavior Order
Published
2023-10-05T17:41Z
EPSS history
Timeline
  • 05 OCT 17:41Z
    Incorrect request error handling triggers server crash in Vapor
    cvelistv5