Unchecked Input for Loop Condition Affecting github.com/apple/swift-nio-extras package, versions <1.9.2 >=1.10.0 <1.10.3 >=1.11.0 <1.14.0



    Attack Complexity Low
    Availability High

    Threat Intelligence

    EPSS 0.05% (15th percentile)
Expand this section
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • published 6 Nov 2022
  • disclosed 2 Nov 2022
  • credit Vojtech Rylko

How to fix?

Upgrade apple/swift-nio-extras to version 1.9.2, 1.10.3, 1.14.0 or higher.


apple/swift-nio-extras is an useful code around SwiftNIO.

Affected versions of this package are vulnerable to Unchecked Input for Loop Condition. SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies. These two objects (HTTPRequestDecompressor and HTTPResponseDecompressor) failed to detect when the decompressed body was considered complete. If trailing junk data was appended to the HTTP message body, the code would repeatedly attempt to decompress this data and fail. This would lead to an infinite loop making no forward progress, leading to livelock of the system and denial-of-service.