Vapor 4.40.1 released!

[NewsBot]

Vapor 4.40.1 has been released.

Fixes an issue where an attacker could perform a denial of service attack against a Vapor application using Metrics. By sending requests to either dynamic paths with values that return a 404 or unknown paths, unlimited counters and timers could be created. This could potentially drain the system and cause knock-on effect on downstream systems.

Link: Release Rewrite metrics path and method to undefined for unknown routes · vapor/vapor · GitHub

[bot]

Corresponding tweet for this thread:

Devtalk (dev_talk)

Share link for this tweet.