Resource exhaustion in Vapor
CVE-2021-21328
Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.018 (78.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 78.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.018 · change: +0.002
Affected products
- Vapor — versions <= 4.40.0
- Vapor Project
Weakness classification (CWE)
References
- github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc (Third Party Advisory)
- github.com/vapor/vapor/commit/e3aa712508db2854ac0ab905696c65fd88fa7e23 (Patch, Third Party Advisory)
- github.com/vapor/vapor/releases/tag/4.40.1 (Third Party Advisory, Release Notes)
- vapor.codes/ (Product)
Frequently asked questions
- What is CVE-2021-21328?
- CVE-2021-21328 is a medium-severity vulnerability in Vapor, classified under Uncontrolled Resource Consumption. CVSS score: 5.3/10. Published 2021-02-26.
- How severe is CVE-2021-21328?
- Medium severity. CVSS v3 base score is 5.3 out of 10.