Resource exhaustion in Vapor
CVE-2021-21328
Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create unlimited counters and timers, which will eventually drain the system. 2. downstream services might suffer from this attack as well by being spammed with error paths. This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.016 (73.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Vapor — versions <= 4.40.0
- Vapor_project Vapor
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
- security-advisories@github.com (Product, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-21328?
- CVE-2021-21328 is a medium-severity vulnerability in Vapor, classified under Uncontrolled Resource Consumption. CVSS score: 5.3/10. Published 2021-02-26.
- How severe is CVE-2021-21328?
- Medium severity. CVSS v3 base score is 5.3 out of 10.