CVE-2022-31019 | DoS Vulnerability in URLEncodedFormDecoder in Vapor
Exp
Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo`. The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow and a process crash. This issue has been fixed in version 4.61.1.
Conclusion & alert: CVE-2022-31019 is rated High Exploit Risk (70.5/100): CVSS High severity, with medium exploitation likelihood (EPSS 1.46%).Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +1.04% over the last day, indicating growing attacker interest.Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
Public exploit references (Exploit-DB) for CVE-2022-31019
Exploit prediction scoring system (EPSS) score for CVE-2022-31019
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).