CVE-2022-24863

HIGH

http-swagger < 1.2.6 - Denial of Service via Improper Handling of HTTP Methods

Title source: llm
STIX 2.1

Description

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.

References (4)

Core 4
Core References
Third Party Advisory x_refsource_misc
https://github.com/swaggo/http-swagger/pull/62
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/swaggo/http-swagger/releases/tag/v1.2.6

Scores

CVSS v3 7.5
EPSS 0.0233
EPSS Percentile 81.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-755 CWE-400
Status published
Products (2)
http-swagger_project/http-swagger < 1.2.6
swaggo/http-swagger 0 - 1.2.6Go
Published Apr 18, 2022
Tracked Since Feb 18, 2026