CVE-2022-31005

Integer Overflow in Vapor's HTTP Range Request

State: Published
Severity: 7.5 High
Published: May 31, 2022
Updated: Apr 22, 2025
Reserved: May 18, 2022

Description

Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
vaporvapor	< 4.60.3Affected

References

https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5
https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1
https://github.com/vapor/vapor/releases/tag/4.60.3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.