Read the docs
TI-2021-12410 Aliases CVE-2021-32742GHSA-pqwh-c2f3-vxmq

Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash

Priority MEDIUM 42CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial of Service) for applications where untrusted data can end up in said function. Vapor does not currently use this function itself so this only impact applications that use the impacted function directly or through other dependencies. The vulnerability is patched in version 4.47.2. As a workaround, one may use an alternative to Vapor's built-in `Data.init(base32Encoded:)`.

Why it matters now

EPSS 0.01199 68th percentileScored 2026-11-07
Fix Fixed github.com/vapor/vapor (SwiftURL): 4.47.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
vaporvaporup to 4.47.1—No fix listedCNA
—github.com/vapor/vapor (SwiftURL)before 4.47.24.47.2Patch availableGHSA-pqwh-c2f3-vxmq
  • vapor Vendorvapor Affected up to 4.47.1 Fixed in — No fix listed CNA
  • github.com/vapor/vapor (SwiftURL) Vendor— Affected before 4.47.2 Fixed in 4.47.2 Patch available GHSA-pqwh-c2f3-vxmq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vapor_project:vapor:*:*:*:*:*:swift:*:*before 4.47.2VulnerableVapor Project
  • cpe:2.3:a:vapor_project:vapor:*:*:*:*:*:swift:*:* Versions before 4.47.2 Vulnerable ·Vapor Project

Remediation

  • Fix · GHSA-pqwh-c2f3-vxmq github.com/vapor/vapor (SwiftURL) Fixed in 4.47.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32742
  2. 2026-10-03 Alias added: GHSA-pqwh-c2f3-vxmq

References

Advisory 3

Other 1

  • TI-2022-13064 DoS Vulnerability in URLEncodedFormDecoder in Vapor CVSS 3.1HIGH 7.5
  • TI-2022-13051 Integer Overflow in Vapor's HTTP Range Request CVSS 3.1HIGH 7.5
  • TI-2026-22762 LeafKit's HTML escaping may be skipped for Collection values, enabling XSS CVSS 4.0MEDIUM 6.9
  • TI-2026-21572 Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster CVSS 3.1MEDIUM 6.1
  • TI-2020-12002 Arbitrary file read un Vapor CVSS 3.1HIGH 8.5
  • TI-2024-14356 Integer overflow in URI leading to potential host spoofing CVSS 3.1MEDIUM 6.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences