CVE-2023-44386
Incorrect request error handling triggers server crash in Vapor
Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Incorrect request error handling triggers server crash in Vapor
Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.
- Record
CVE-2023-44386- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-231, CWE-617, CWE-696
- Updated
- 2026-11-02
EUVDEUVD-2023-2631
Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.
- Record
EUVD-2023-2631- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3mwq-h3g6-ffhm
Vapor's incorrect request error handling triggers server crash
Vapor incorrectly handles errors encountered during parsing of HTTP 1.x requests, triggering a precondition failure in swift-nio due to API misuse and causing immediate termination of the server process.
Impact
This is a denial of service vulnerability, impacting all users of affected versions of Vapor. Because the crash is an explicit assertion failure, there is no corruption of process state and no risk of data leakage or unauthorized code execution. Total impact is limited to an immediately recoverable service interruption.
Patches
The issue is fixed as of Vapor release 4.84.2.
Workarounds
None known at this time.
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Vapor repo
- Ask in Vapor Discord
Acknowledgements
Full credit for reporting this issue goes to @t0rchwo0d, with additional thanks for responsibly disclosing.
- Record
GHSA-3mwq-h3g6-ffhm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-231
- Updated
- 2026-11-02
NVD
Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.
- Record
CVE-2023-44386- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-231, CWE-617, CWE-696
- Updated
- 2026-11-02
OSV
Incorrect request error handling triggers server crash in Vapor
Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as of Vapor release 4.84.2.
- Record
CVE-2023-44386- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-231, CWE-617, CWE-696
- Updated
- 2026-11-02
OSVGHSA-3mwq-h3g6-ffhm
Vapor's incorrect request error handling triggers server crash
Vapor incorrectly handles errors encountered during parsing of HTTP 1.x requests, triggering a precondition failure in swift-nio due to API misuse and causing immediate termination of the server process.
Impact
This is a denial of service vulnerability, impacting all users of affected versions of Vapor. Because the crash is an explicit assertion failure, there is no corruption of process state and no risk of data leakage or unauthorized code execution. Total impact is limited to an immediately recoverable service interruption.
Patches
The issue is fixed as of Vapor release 4.84.2.
Workarounds
None known at this time.
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Vapor repo
- Ask in Vapor Discord
Acknowledgements
Full credit for reporting this issue goes to @t0rchwo0d, with additional thanks for responsibly disclosing.
- Record
GHSA-3mwq-h3g6-ffhm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-231
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/vapor/vaporSwiftURL |
4.83.2 up to 4.84.2 | 4.84.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-44386 is a medium vulnerability (CVSS 5.3) in Vapor, published October 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in github.com/vapor/vapor 4.84.2.
References
github.com/vapor/vapor/security/advisories/GHSA-3mwq-h3g6-ffhm
nvd.nist.gov/vuln/detail/CVE-2023-44386