CVE-2023-44386 Incorrect request error handling triggers server crash in Vapor

What is CVE-2023-44386?

CVE-2023-44386 is a medium-severity denial of service vulnerability in vapor, published on 5 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.

Weakness: CWE-696, CWE-617, CWE-231

Which versions are affected by CVE-2023-44386?

2 open source packages ship an affected version, including github.com/vapor/vapor. It affects 1 product.

Products include Vapor Vapor.

How do I fix CVE-2023-44386?

Upgrade github.com/vapor/vapor to 4.84.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-44386 being exploited?

There is no known exploitation of CVE-2023-44386 in the wild and no public exploit code.

Other vulnerabilities in vapor

• CVE-2022-31019 DoS Vulnerability in URLEncodedFormDecoder in Vapor High 7.5
• CVE-2022-31005 Integer Overflow in Vapor's HTTP Range Request High 7.5
• CVE-2024-21631 Integer overflow in URI leading to potential host spoofing Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3mwq-h3g6-ffhm.