Denial of service in http-swagger
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| swaggo | http-swagger | before 1.2.6 | 1.2.6 | Patch available | CNA |
| — | github.com/swaggo/http-swagger (Go) | before 1.2.6 | 1.2.6 | Patch available | GHSA-xg75-q3q5-cqmv |
- http-swagger Vendorswaggo Affected before 1.2.6 Fixed in 1.2.6 Patch available CNA
- github.com/swaggo/http-swagger (Go) Vendor— Affected before 1.2.6 Fixed in 1.2.6 Patch available GHSA-xg75-q3q5-cqmv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:http-swagger_project:http-swagger:*:*:*:*:*:*:*:* | before 1.2.6 | Vulnerable | Http-swagger Project |
- cpe:2.3:a:http-swagger_project:http-swagger:*:*:*:*:*:*:*:* Versions before 1.2.6 Vulnerable ·Http-swagger Project
Remediation
- Fix · CNA http-swagger (swaggo) Fixed in 1.2.6
- Fix · GHSA-xg75-q3q5-cqmv github.com/swaggo/http-swagger (Go) Fixed in 1.2.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Quay 3 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24863
- 2026-10-03 Alias added: GHSA-xg75-q3q5-cqmv
References
Advisory 4
More Http-swagger Project Http-swagger vulnerabilities
- TI-2024-16918 http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-24863 · CVE Program
- CVE-2022-24863 · NVD
- FIRST EPSS
- GHSA-xg75-q3q5-cqmv · GitHub Advisory Database · CC BY 4.0
- CVE-2022-24863 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences