CVE-2022-24863

 

Published at: - 18-04-2022 09:15

Last modified: - 27-04-2022 03:31

Total changes: - 3

Description

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://github.com/swaggo/http-swagger/releases/tag/v1.2.6
• https://github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049e
• https://github.com/swaggo/http-swagger/pull/62
• https://github.com/swaggo/http-swagger/security/advisories/GHSA-xg75-q3q5-cqmv

 

Keywords

NVD

 

CVE-2022-24863

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures