CVE-2022-31005 Integer Overflow in Vapor's HTTP Range Request

What is CVE-2022-31005?

CVE-2022-31005 is a high-severity vulnerability in vapor, published on 31 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.

Weakness: CWE-190

Which versions are affected by CVE-2022-31005?

2 open source packages ship an affected version, including github.com/vapor/vapor. It affects 1 product.

Products include Vapor Vapor.

How do I fix CVE-2022-31005?

Upgrade github.com/vapor/vapor to 4.60.3 or later.

Is CVE-2022-31005 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31005 exists.

Other vulnerabilities in vapor

• CVE-2022-31019 DoS Vulnerability in URLEncodedFormDecoder in Vapor High 7.5
• CVE-2024-21631 Integer overflow in URI leading to potential host spoofing Medium 6.5
• CVE-2023-44386 Incorrect request error handling triggers server crash in Vapor Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vj2m-9f5j-mpr5.