High severity · published Apr 18, 2022
CVE-2022-24863
http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0
7.5
CVSS
2.4%
EPSS
No
On KEV
Description
http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HT
Http-swagger · Http-swagger Project
before 1.2.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24863
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24863
Patch
https://github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049e
Third Party Advisory
https://github.com/swaggo/http-swagger/pull/62
Release Notes
https://github.com/swaggo/http-swagger/releases/tag/v1.2.6
Third Party Advisory
https://github.com/swaggo/http-swagger/security/advisories/GHSA-xg75-q3q5-cqmv
More from Http-swagger
6.1
CVE-2024-25712
http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a…