CVE-2022-31005

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a Content Delivery Network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
vapor	vapor	< 4.60.3

References

https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1Patch, Third Party Advisory
https://github.com/vapor/vapor/releases/tag/4.60.3Release Notes, Third Party Advisory
https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5Exploit, Third Party Advisory
https://github.com/vapor/vapor/commit/953a349b539b3e0d3653585c8ffb50c427986df1Patch, Third Party Advisory
https://github.com/vapor/vapor/releases/tag/4.60.3Release Notes, Third Party Advisory
https://github.com/vapor/vapor/security/advisories/GHSA-vj2m-9f5j-mpr5Exploit, Third Party Advisory

Timeline

Published: May 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-310067.5indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions o CVE-2022-310077.2eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with CVE-2022-310087.5RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation CVE-2022-310096.5wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partners may render the iOS CVE-2022-31015.5A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently rest CVE-2022-310117.8TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditio CVE-2022-310127.3Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows CVE-2022-310139.8Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validatin CVE-2022-310143.5Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impac CVE-2022-310155.9Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread CVE-2022-310166.5Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory co CVE-2022-310172.6Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configur