-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
SwiftSwift| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/vapor/vapor | swift | < 4.60.3 | 4.60.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the unvalidated handling of HTTP Range headers in FileMiddleware's range processing. The pre-patch version of asByteBufferBounds: 1) Didn't validate start/end positions against file size 2) Allowed negative values 3) Calculated 'end - start + 1' without overflow checks. The commit adds multiple guard clauses and overflow detection, confirming this was the vulnerable area. The test cases added in FileTests.swift specifically target this function's edge cases, and the CWE-190 classification directly maps to the integer overflow in range calculation.
Ongoing coverage of React2Shell