Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-1872 | Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1. |
 Github GHSA |
GHSA-qvxg-wjxc-r4gg | Vapor vulnerable to denial of service in URLEncodedFormDecoder |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 10 Nov 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-04-22T17:54:38.010Z
Reserved: 2022-05-18T00:00:00.000Z
Link: CVE-2022-31019
Vulnrichment
Updated: 2024-08-03T07:03:40.210Z
NVD
Status : Modified
Published: 2022-06-09T13:15:08.393
Modified: 2026-06-17T04:44:37.097
Link: CVE-2022-31019
Redhat
No data.
OpenCVE Enrichment
No data.