Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor's vapor_urlparser_parse function uses uint16_t indexes when parsing a URI's components, which may cause integer overflows when parsing untrusted inputs. This vulnerability does not affect Vapor directly but could impact applications relying on the URI type for validating user input. The URI type is used in several places in Vapor. A developer may decide to use URI to represent a URL in their application (especially if that URL is then passed to the HTTP Client) and rely on its public properties and methods. However, URI may fail to properly parse a valid (albeit abnormally long) URL, due to string ranges being converted to 16-bit integers. An attacker may use this behavior to trick the application into accepting a URL to an untrusted destination. By padding the port number with zeros, an attacker can cause an integer overflow to occur when the URL authority is parsed and, as a result, spoof the host. Version 4.90.0 contains a patch for this issue. As a workaround, validate user input before parsing as a URI or, if possible, use Foundation's URL and URLComponents utilities.
{
"cwe_ids": [
"CWE-1104",
"CWE-190",
"CWE-20"
]
}[
{
"source": "https://github.com/vapor/vapor/commit/6db3d917b5ce5024a84eb265ef65691383305d70",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-21631-18afa333",
"digest": {
"function_hash": "16880746747253849440695931017775499585",
"length": 1808.0
},
"target": {
"function": "parse_url_char",
"file": "Sources/CVaporURLParser/urlparser.c"
}
},
{
"source": "https://github.com/vapor/vapor/commit/6db3d917b5ce5024a84eb265ef65691383305d70",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-21631-248714f3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"17434575628736631962865991454484431829",
"326916984526218712328670304636359404632",
"79830100334268615147747084161387745503",
"336585904230619229129395505222900936075",
"300730349695976122178075374741942497354",
"321915828569100244350943633204330566254",
"43746521668184247370433926204069249931",
"277696707804110538818930531546648261186",
"106718123880905673666044540453447879674",
"335131146823302354618049237494983326406",
"327628052317792527322787177992704548591",
"195786561343249163393582661356868196086",
"190587701284672821039697613503368256266",
"135209044934393970656463808187985224514",
"86749240977742978865700346364484466470",
"64206905173122702104511299943506833101",
"89105003325489519780749870848425299103",
"155557313598088747360553987581553073220",
"188770435768871056977715405845350930250",
"261552714314399759883091141627332355365",
"300575736435232104696363824923440784640",
"326837279966304571251033216050947541265",
"33243145928327863469910336960331006999",
"102720352022033088049246732870111586409",
"264623132507252499282487352019645871596",
"257478318362178677371461170685710463174",
"158266185973737438173686507318516710837",
"308518079802662106892248360056453184422",
"260844574696026486743105587262678396415",
"34274902828911908350321619479006618568",
"335103853697052640581076625973745766362",
"176537540713323944404318229528930593352",
"224338824149411653358067545093347708936",
"105157880597394261527054367680638544517",
"144004915338855323557220967094060683248",
"162198112384863382194664814339748572571",
"91054609721646434453774016366640359176",
"92841200477789425628346296608899510254",
"183799920228197968195559344284943127959",
"103454573958186544388853777564611632443",
"276518929252809254114361522677824776839",
"86682896674568787226538102493386831457",
"170849057557623364122375038946239646275",
"75293515591925829258804849481078439013",
"282314372207023477546642282866397972440",
"141009839662305485070779132259923793297",
"260852378877960640226880715183559335485",
"17968320474676403978085543268259944201",
"242662354845177717754371391259434658718",
"313154431145358234286016673541976954738",
"303018995970336003976782466428878336374",
"8461468596909342162559996143670585388",
"147218062522430889106229594156995518758",
"147218062522430889106229594156995518758",
"147218062522430889106229594156995518758",
"147218062522430889106229594156995518758",
"216813698229687449713306358228730547626",
"294405500700569331615304234218722175805",
"137698746496916986778636381437966447417",
"29027260321370840749998028026037434344",
"198769926226558385579409888648568291077",
"201791246014346449841828052646000975909",
"31211828843348979826782548677358013293",
"33268818780306960983528994997884720408",
"18087652386959163665414740007714761379",
"28276009013712924731358943014975224861",
"329566202046466577398091295186193208219",
"171806811750798017305153826463072595580",
"169121872704391215088230415656309816874",
"168961683799862055548656007619194368713",
"79568729280462248107046706444294046503",
"4338086815215012776298806844027052123",
"13612564908013017790812761963448066160",
"164281911895439284202742818229731541065",
"218811947780886439278480704879864683601",
"175025227736713368642232168101005248775",
"211052044165807436988039177193878412123",
"153176025506974636428432913370510078924",
"294151264943569783306671533255975905335",
"222158674928578369029679024913324158262",
"265909292307866549724871718993364227225",
"208610890350883194834215736159161774885",
"123978708795284722747324507559184999047",
"165143938069615484799992100227918481621",
"118045067017226682785620456416543502731",
"145450565772069357324092671802622456857",
"22511543717362713751429201682673981796",
"238447621639416639844220792216436511859",
"303188325993278022031541352817062550034",
"223450553776868131039370990309467213485",
"218889460571529922178819837521517224458",
"72780502865979777837081706813911727396",
"19670671959758268837773383043701983553",
"92431120216208420449074599092947003980",
"195583906662897901827246976816216807923",
"186972439511344891089881913921522489730",
"1130245668660051860066964756675246808",
"189005918952283479781392492706411081143",
"89816130225180482578948092315543001542",
"114283563786499559813397954206571682375",
"130516740617381596217666564515057713570",
"170744677944227617402936982008949776681",
"183641582585737022377844498966025643738",
"134329040545210007132145553952284527168",
"200850288254564819572533170629824008322",
"151291644374502846695257620515287687342",
"41279674606191545992206152795806688294",
"199470987480343223512483122409339187036",
"189035737855857903178233554761429638728",
"38582053689014477031182636049719451013",
"170241654591102928529560692224101477343",
"110699419624506788583330268214242785589",
"185300065177881657695971707462281086360",
"71636572594295278759237594497810681180",
"226613040984428293752283692003794180343",
"20124942114629061480420849184064769614",
"92752839443131269126768751362476478326",
"12175030406328584821138002726310249432",
"26774345311842046016226668392827052972",
"333234361344740263623195856194328725536",
"303379587823131072101231113825896712900",
"41105144157097827435188490963252263299",
"69680955512147105745184738338058635992",
"281911270486681625166024520780092691476",
"172471631178403236807820761920575028722",
"308408376082156978115612330489703519882",
"300747648797491755762679009746279502291",
"69478504831982643588250877777103851616",
"216209778463725388187523504126259357966",
"113272531505158915471937386932908697394",
"182146934820373645944285589291562575904",
"114271468997096348432223143849394736168",
"205705648306629108234209908334999074437",
"136500636419374893617385993208722885978",
"151599355700368347601020688211153779666",
"205510239086996247761338932334266924868",
"127358660637261962185055827136610284571",
"263686101391215608716793397824503422341",
"188259231202300136772481027174870559651",
"208419910463931521250940702642406347534",
"245504539035779494329724841599124149135",
"275807685077461188055931720262305063489",
"50901374709271155195264076608384280000",
"59670462304304384220255837883042322358",
"335133484364642949512601697340814438626",
"97847178562005493306530109082320618229",
"165017988729837393173464792593217532481",
"271326514745667484297714417577572563978",
"268732114349708331175699365291047110711",
"115676936835474690457562146705485861480",
"204906084750402602737770324489305565877",
"234191677403696110060240936567864298712",
"182218052873661781669624167445877049680",
"34160564534851597911586773215991400857",
"318265241895893942852933901651042198073",
"8649681325797819150671707349895994023",
"41859989230186152869627527185028296732",
"240371415573472656647388303048813395978",
"64866008585386142951036475520627778199",
"324939798611226812308308517287309466755",
"103773410420027356318444266646801967560",
"140431735605112761210291745470608009016",
"173922560593982501594371092295960932372",
"189494993394805635173931108181021867060",
"51320678079098652951157538992496446446",
"269853662758999113775261355798691588227",
"90785128861517824606857719077755857228",
"299336161598726741217276483080549494210",
"162180604513271888454880403401771266934",
"24959452583557525256056012101587959511",
"331529535367094668745092905053627630025",
"130490577149507025801592993787288819251",
"178925918822434725411377575947941338094",
"303023857429768418260280558656312543336",
"90796661073069716394679694061064831188",
"269344358122705302291399625831206006401",
"272047527759943361039779996444306469475",
"91420390490078962760233825595943245081",
"271387399004889767920028519063381846177",
"32460766873571752754962670267847021599",
"246814884085730279664487423646423406907",
"269495356198128103120602927319713551768",
"49937654735429792596266110126823351546",
"225065430208891047126105588810030978974",
"225851607335660835903177911332424660815",
"160821564974595818900550022872255507858",
"280549365573016108380137917859078842180",
"251222362585236469425747703883759999066",
"305664424359858932938709125186723755702",
"69250017477288239171306418055273678291",
"25633969502513729367316901095619424167",
"7613331922785776061472308957271481571",
"97221218535808639446947842689722036844",
"291938180377955577709448914325807526117",
"232766447387638754551832352159383198582",
"89850324622313389912297176252128496452",
"155162449507593769491939203729717180506",
"179423016968468575721642869976702315887",
"236292262178691724767616557177991821876",
"310276792926885011496241681938507151653",
"81499219455829001619356441433957221289",
"157110411317058123075655999637027584966",
"239772881389746908544608386909275154388",
"214473328129285240672901560759777823777",
"198331323626630167783167859173647854295",
"134248802236134924321412796582585343228",
"275210652033806222308448936719984895096",
"282747299392886260899920058324887493934",
"85037611701210505757040790189622473150",
"96280815056800299227388217720625238131",
"188838227296576865662975952882667486832",
"134397983112673565222518487197309315088",
"305688703407835807181859416510329021790",
"249305345546662005153038995928238871191",
"200218284824726483544516005524154386547",
"191099515148080632820161029349120215389",
"223413365200646476620559706776645467069",
"163254893786484000450125197733728547589",
"300435440571687283813658324522717768637",
"132352049644262030146984770742861564384",
"209284196595018720489441420911828474291",
"323970054574421724239545686361818603747",
"112569792037153873213431596051880612114",
"3759788863850466402698465180062337925",
"76715305969196245017057330303307760498",
"33152548812792282198576253638241956702",
"170297935326659432184683238407225530558",
"191099515148080632820161029349120215389",
"319713906915578285289519187068434679609",
"179446810679564557747885753464685653846",
"160918779412013486386752291406637439358",
"201417256442432061504678332212221806192",
"73677903676198375451370680085017879330",
"302463542278430105713531649151351235109",
"212986752706701871233862188306264989612",
"55570070666737830044347602312472875233",
"273356607815434085744128332387100692524",
"569162228935651647990667443804240569",
"198157528471948200766303343446623285318",
"190828379907709835365444116117594147595",
"5708265856270505859182865647310128188",
"222998547093302999749793318716598020519",
"48832942017413460089338062160110518449",
"96280815056800299227388217720625238131",
"188838227296576865662975952882667486832",
"73924052586480056350037018211638665239",
"91591984207827658426898828494195634113",
"276065201807131422179676003296833842824",
"198157528471948200766303343446623285318",
"50288987111912773102611878563535282395",
"163390330017406173868514175977017836495",
"273044645211350846033584871890401335473",
"167918160585907999999122946211498815776",
"83216988215787849693881201765302533860",
"250827823157113729020590063606813395260",
"41810777565070505442570159930504707955",
"274382500347522375952183988948026215226",
"46384681899448044075095282119268320916",
"156496386468286919475844405652300712566",
"274287689037461164181328781884413963543",
"171119534970370197660354248487296329478",
"313802600938521795235364825393251094833",
"211177952556726025254423176660332631933",
"193227805161736371704821089544671351892",
"97208633558459234704355356730349676003",
"76302887174444272686689595441705321297",
"26982655175844003503824799066075758647",
"154204657523387156918163429939315635557",
"126090467069887912368462442863736076586",
"1147701031182670890409233746791150193",
"156946475793753878436341926210777940181",
"163658085542138709068961375741756540665",
"81008868440514222737135139073304326678",
"143530090574729832475705951706316324689",
"159985163616979320093318269298640627650",
"222671892236134502727769480806574114087",
"38678645420004083291058646449226060149",
"53521154234662093282972095450063659810",
"254679979486122346198904050133972850885",
"39197118683582543773264678157435068133",
"258868753474977055356558353130562006726",
"233248206783056723183269217226632903293",
"168910783222965008605987709987755959269",
"255571072329915998618318248425855276589",
"145770777793641076736393627754540151662",
"118114482315709609640782958442747815281",
"209361401072917065552178788089314679996",
"186046018395982520980478838760815012574",
"236463969233106684767044419206016799879",
"210957113314005061660832479511078243684",
"241914358034480507449133482010989060518",
"143176828359504016055243193459243776603",
"10598507679969917305785111485759041319",
"216150899969733877002225959379375862858",
"299831122264961541897480398775704623071",
"38014726121967111787288258834107544505",
"271129018131498474484293731580233136147",
"84664320936057164600270242200328679382",
"252085737469504521625895083769614068337",
"258519223075397928677951863137852009300",
"143980654110535857087463792447444696402",
"25031314795248521511137926403985104014",
"39151802263674777578984034076011233120",
"252021808567565980540318513588627000515",
"160362619109236759284453298395684913172",
"133569355818994179108587389218206759517",
"128781641428747579124222259166229102717",
"100121227811545697464817267434794178859",
"298321189270130979013340599708869224116",
"258054029456920989435380497795815611112",
"318488991085997531446921190904032954037",
"31280273261614530328552800103100557743",
"163390330017406173868514175977017836495",
"273044645211350846033584871890401335473",
"8373851238921092490685667414663727429",
"237989489649066399410193972112648833828",
"282797408876724669973389349589105436394",
"92470521813521392824610381984182852457",
"333021323594685182183314266253464503658",
"40577874227589029403067029954822495640",
"86463512308743099626913914653738301247",
"183077904185143541542453747251997253678",
"236685140869142611010290550074867216802",
"238348227680131486650819041317612309250",
"327966082167811254190576627750013168651",
"85845767754735387799975699909077532201",
"280522811845222589786297168725025912781",
"74552482151757191729892276050604646536",
"81657888932464894228316390626005011452",
"99660932196933409821518575712767264928",
"276712158849284777208571093908993562640",
"72701348290247071508040548227719483307",
"148227595705141589968159603783680737101",
"73055371573875204767226915079748822022",
"167473433906360868369962946944442403383",
"145655530094851886328344074095279910772",
"151992928966563503451607597615654564029",
"112480491067602645281721764564179168987",
"242907119372008686449481475169288883422",
"235525732598232800008648805527918940835",
"75034491757099196647360415618924095334",
"145655530094851886328344074095279910772",
"111941362552029176693290472190878319813",
"321268569004512945762670608831355381747",
"295141721725686637551456370208535269199",
"300566597366577437032934321828421861021",
"232894822051143203771202910850399037512",
"138846097026260407468625599851304255132",
"193764668521376674793710287142745003748",
"243075616222738114270885059377247524910",
"288161394838347404272904914063425267770",
"82722820247963534809062628987361191323",
"106274834287414561613613272043854772064",
"339178761081373817033462464689269920512",
"62437234668640288355639445266021594136",
"112452858836377964833609290702585447204",
"171309687304916390291901193636304199276",
"89516503164853515024413297867349703466",
"63453830261993001210267971062170769681",
"27024098444264777375717589814296962621",
"239241040478998997800928476153756426397",
"130604441579956109913613959683905496638",
"237546899953760669756094268533166830839",
"7471719307032304908621303987226969747",
"273044645211350846033584871890401335473",
"55458758610863002367382130741342796316",
"131254257701213021207221986569107482977",
"163748233896105170190798248545713981185",
"88313383007755035429855467436416326729",
"292143505070377685159416845798964243875",
"313284711949230606738123400491693718555",
"281595790353730487925308142423725647824",
"250646942641083404251419685972404065991",
"270564953105054832524228919602574876007",
"185294952551731208355199267725341404178",
"53731735300509089463818994008381092318",
"94639522015876223904556928589043441233",
"53821542993362105878303171794938246527",
"187380898765509520108608385597802675821",
"128019445814062610609077677504797857570",
"63544552792561325102349391447796071063",
"98057762726795341531481300557154757250",
"257279594944366299067624145088475835974",
"130931694832063704732370933131835928647",
"280698580380723211496918685412962083917",
"316101959703603962793338819983272867198",
"30216747303902623145989372190960159275",
"5968364174681337621870775491725532900",
"164015813986032412186798871695859090728",
"198451104306401609091491244406287133347",
"103949166103048973271050706787565980954",
"92887518266549465212816180295461933890",
"43342380965737014785969624191883613072",
"334938795409406718386371341587510383198",
"158243913338944250452416088571952462114",
"148763498803336612331096579152176911275",
"176573966192484256154377966532908959723",
"169511550627143485688633506488176107696",
"96484554182996066708039404774678769612",
"194015294516490638350281062878015823026",
"202099428005242618729530281728018382194",
"17112492305357758727324275654972581697",
"185045495592299649201133819625356359514",
"242248399786811005023877173589646824681",
"26200501080715487912787681370036707299",
"422664640945176224293600071637768304",
"218319109952549952045071021863427345145",
"276230866339712825394431129961894755976",
"41541653696622540481073241755827899089",
"86629706041503579137276235842590665434",
"71793179642023702607547867261971072960",
"273800962103162922258100795312144554666",
"255334381504696296403994276834022248656",
"307392659242966502581355547391783004325",
"104930836751153585255646240157807434544",
"248751317729776631248089328308584628451",
"319937948332256625148772263453968541662",
"84733452467423968910097314906276318923",
"116542186403028214743504181590185912131",
"314914542419007638197649207844512209161",
"221945203949341324244077060363320077739",
"28224231231759004349051854088678911335",
"317057111641950298210006477133284143624",
"187906854709239311247045548058843531754",
"295320494554474613818641468308415894276",
"147821225222984683266930489320249021975",
"164156008447430871651405231308276808183",
"9640421740974409522405643683153866592",
"105243385001843644985267120291635380944",
"224535934662315206662520166911946884214",
"145869893749498137793170088927383049222",
"48847396210646901079686135648033994671",
"76038328729528756145897750628349376024",
"320414155105781027185027356411480679373",
"78132482856622086098611293367443492179",
"279933468137262122340454137666206788233",
"162279794941829135913377442626697932178",
"113149686665092981092217144743679608914",
"160977020142195094026737550875410937665",
"68965392207516894049010222869477143655",
"285603277094607378277350208321467610328",
"79037004922572024103266916985526154852",
"252591547736470007119953918429093160159",
"198650392001477638215645234273743695724",
"165943466177150169049772842017578417268",
"10306081794301393786664202791948364317",
"276813008367337901947471170082446484818",
"249561417150995397883699210730057609047",
"168374078441747372857320684535965085040",
"274971541709391132632089483527108208108",
"316180061471913339013226355262659164660",
"64113913378004517599835819514397535740",
"251635385697803116226097112265000824984",
"227279367305904208055556272668861808673",
"190637099482908683193442233497531104706",
"329665822615953658018914205961364111995",
"318252752726542506450994578388197037021",
"148437640019390059440119821699228007447",
"255882025026418366552923969707458867260",
"286753749300107940888935556464967995362",
"186930860203359032232940492839991314301",
"73579746575376996549009301230104125140",
"313667804750813952000627602223449421881",
"135287315886272801624706562108113090286",
"280577692144615697362863173979123357451",
"277451853728798656014895556251540491069",
"39311224723316709612472951831037898758",
"193990821446422659496365841714513276284",
"249921282110009946250555204912738127627",
"160172879938783243343614978360599802501",
"126156533536734606161716183941579230486",
"108438101616428148352420483604914404275",
"1984392827895156147853011739188800428",
"244148467718412329484821812306086392040",
"55319991697349481849496242093233694208"
]
},
"target": {
"file": "Sources/CVaporURLParser/urlparser.c"
}
},
{
"source": "https://github.com/vapor/vapor/commit/6db3d917b5ce5024a84eb265ef65691383305d70",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-21631-3f10b354",
"digest": {
"function_hash": "51530165114433160403394260222310942467",
"length": 82.0
},
"target": {
"function": "urlparser_url_init",
"file": "Sources/CVaporURLParser/urlparser.c"
}
},
{
"source": "https://github.com/vapor/vapor/commit/6db3d917b5ce5024a84eb265ef65691383305d70",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-21631-40ac49ec",
"digest": {
"function_hash": "311193432472638571424306267019930623630",
"length": 1249.0
},
"target": {
"function": "http_parse_host_char",
"file": "Sources/CVaporURLParser/urlparser.c"
}
},
{
"source": "https://github.com/vapor/vapor/commit/6db3d917b5ce5024a84eb265ef65691383305d70",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-21631-54c0509e",
"digest": {
"function_hash": "221448621458861944780339405803007822877",
"length": 1944.0
},
"target": {
"function": "vapor_urlparser_parse",
"file": "Sources/CVaporURLParser/urlparser.c"
}
},
{
"source": "https://github.com/vapor/vapor/commit/6db3d917b5ce5024a84eb265ef65691383305d70",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2024-21631-665a2e13",
"digest": {
"function_hash": "40475023437740061449536178889412082520",
"length": 1854.0
},
"target": {
"function": "http_parse_host",
"file": "Sources/CVaporURLParser/urlparser.c"
}
},
{
"source": "https://github.com/vapor/vapor/commit/6db3d917b5ce5024a84eb265ef65691383305d70",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2024-21631-ce33e498",
"digest": {
"threshold": 0.9,
"line_hashes": [
"35868084136675750692842540233664324311",
"118178280242385964428498815450043346155",
"147258906926743395923262297582667391109",
"153132684754283528645856405812844986581",
"60237435307691947207843016580838139524",
"225719927409290628869540578337958888457",
"276945180586690541017015044651745280404",
"53120719716162691803706997017901906623",
"1894028021129716217572523830436514178",
"129788807190333901568764379616618968377",
"118534819405482547334931015947923233536",
"141068722251177087708749265231435488151",
"332671269704762439300837830057812813214",
"47901347650293359351267443395832913892",
"145623466124278764652010598514108316477",
"282875436772292511542931028144352785452",
"164971225851189212879705664756191172254",
"291654218037432315283008484511921487991",
"104546539476284776728920048034537520930",
"323794847058457279004188980629108539094",
"248928239088087948134185721191852042657",
"178283357177646204669932590630181653288",
"216562004889863059698830562628908200016"
]
},
"target": {
"file": "Sources/CVaporURLParser/include/urlparser.h"
}
}
]