CVE-2022-31019

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-310208.8Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upCVE-2022-310215.3Ursa is a cryptographic library for use with blockchains. A weakness in the Hyperledger AnonCreds specification that is not mitigated in theCVE-2022-310225.5Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. ThCVE-2022-310237.5Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensCVE-2022-310246.5richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.CVE-2022-310255.3Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` anCVE-2022-310267.5Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causiCVE-2022-310276.5OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, aCVE-2022-310287.5MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-0CVE-2022-310294.8AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in theCVE-2022-31037.8off-by-one in io_uring module.CVE-2022-310305.5containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can
CVE-2022-31019: High severity, CVSS 7.5 | Vulnix