CVE-2021-21328

Katalog CVE

CVSS 5.3 · Medium EPSS 1,8%

Kerentanan Uncontrolled Resource Consumption pada vapor project vapor. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters.

Rincian

Terbit di NVD

26 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vapor/vapor/commit/e3aa712508db2854ac0ab905696c65fd88fa7e23 patch · advisory pihak ketiga
• https://github.com/vapor/vapor/releases/tag/4.40.1 release notes · advisory pihak ketiga
• https://github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc advisory pihak ketiga
• https://vapor.codes/ product