CVE-2021-32742 - CVE House
Back to Database
Status published High CVE-2021-32742

Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash

Vulnerability Description

Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial of Service) for applications where untrusted data can end up in said function. Vapor does not currently use this function itself so this only impact applications that use the impacted function directly or through other dependencies. The vulnerability is patched in version 4.47.2. As a workaround, one may use an alternative to Vapor's built-in `Data.init(base32Encoded:)`.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32742

Credits & Attribution

No credits recorded in the NVD database.

References

More from vapor

View All →
CVE-2024-21631
Integer overflow in URI leading to potential host spoofing
Medium 6.5
CVE-2023-44386
Incorrect request error handling triggers server crash in Vapor
Medium 5.3
CVE-2023-31136
PostgresNIO processes unencrypted bytes from man-in-the-middle
Low 3.7
CVE-2022-31019
DoS Vulnerability in URLEncodedFormDecoder in Vapor
High 7.5
CVE-2022-31005
Integer Overflow in Vapor's HTTP Range Request
High 7.5

Affected Vendor

Affected Software

vapor
Vulnerable Versions:
<= 4.47.1

Timeline

Official Publish: July 9th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-502

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1068 Exploitation for Privilege Escalation
Privilege Escalation