The Vapor Project develops a focused web application framework written in Swift, with its vulnerability profile centered on the core Vapor framework product and characterized by deserialization flaws, path-traversal issues, and uncontrolled resource-consumption weaknesses that reflect common risks in server-side web frameworks. Treat this as a compact vendor profile; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Vapor Project over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-32742CRITICAL Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing | Jul 9, 2021 | 9.1 | 26 | NO | NO |
CVE-2026-28499MEDIUM LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) | Mar 18, 2026 | 6.1 | 23 | NO | NO |
CVE-2026-27120MEDIUM Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters matc | Feb 20, 2026 | 6.1 | 21 | NO | NO |
CVE-2024-21631MEDIUM Vapor is an HTTP web framework for Swift. Prior to version 4.90.0, Vapor's `vapor_urlparser_parse` function uses `uint16_t` indexes when parsing a URI's components, which may cause | Jan 3, 2024 | 6.5 | 20 | NO | NO |
CVE-2023-31136MEDIUM PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker i | May 9, 2023 | 5.9 | 20 | NO | NO |
CVE-2022-31005HIGH Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the | May 31, 2022 | 7.5 | 20 | NO | NO |
CVE-2021-37634MEDIUM Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. This affects anyone passing unsanitised | Aug 9, 2021 | 6.1 | 20 | NO | NO |
CVE-2022-31019HIGH Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following reques | Jun 9, 2022 | 7.5 | 19 | NO | NO |
CVE-2021-21328MEDIUM Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the | Feb 26, 2021 | 5.3 | 19 | NO | NO |
CVE-2023-44386MEDIUM Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections w | Oct 5, 2023 | 5.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Vapor Project.
Media articles that mention a CVE ID that affects a product developed by Vapor Project — matched by CVE ID, not by vendor name.