Vapor vulnerabilities

Products

• Vapor 7
• Leaf-kit 3
• Leafkit 3

Newest

• vapor leafkit, leaf-kit +1 more LeafKit's HTML escaping may be skipped for Collection values, enabling XSS CVE-2026-28499 Fix available 6.9 MediumMarch 16, 2026
• vapor leaf-kit, leafkit +1 more Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster CVE-2026-27120 Fix available 6.1 MediumFebruary 19, 2026
• vapor Integer overflow in URI leading to potential host spoofing CVE-2024-21631 Fix available 6.5 MediumJanuary 3, 2024
• vapor Incorrect request error handling triggers server crash in Vapor CVE-2023-44386 Fix available 5.3 MediumOctober 5, 2023
• vapor postgresnio, postgres-nio +1 more PostgresNIO processes unencrypted bytes from man-in-the-middle CVE-2023-31136 Fix available 3.7 LowMay 9, 2023
• vapor DoS Vulnerability in URLEncodedFormDecoder in Vapor CVE-2022-31019 Fix available 7.5 HighJune 6, 2022
• vapor Integer Overflow in Vapor's HTTP Range Request CVE-2022-31005 Fix available 7.5 HighMay 31, 2022
• vapor leafkit, leaf-kit +1 more LeafKit allows XSS with untrusted user input CVE-2021-37634 Fix available 7.4 HighAugust 9, 2021
• vapor Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash CVE-2021-32742 Fix available 7.5 HighJuly 9, 2021
• vapor Denial of Service CVE-2021-21328 Fix available 5.3 MediumFebruary 26, 2021
• vapor Arbitrary file read un Vapor CVE-2020-15230 Fix available 8.5 HighOctober 2, 2020