CVE-2022-24863

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.

• CWE-400
• CWE-755

• https://github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049ePatch, Third Party Advisory
• https://github.com/swaggo/http-swagger/pull/62Third Party Advisory
• https://github.com/swaggo/http-swagger/releases/tag/v1.2.6Release Notes, Third Party Advisory
• https://github.com/swaggo/http-swagger/security/advisories/GHSA-xg75-q3q5-cqmvThird Party Advisory
• https://github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049ePatch, Third Party Advisory
• https://github.com/swaggo/http-swagger/pull/62Third Party Advisory
• https://github.com/swaggo/http-swagger/releases/tag/v1.2.6Release Notes, Third Party Advisory
• https://github.com/swaggo/http-swagger/security/advisories/GHSA-xg75-q3q5-cqmvThird Party Advisory

Published

Apr 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24858next-auth v3 users before version 3.29.2 are impacted. next-…6.1
• CVE-2022-24859PyPDF2 is an open source python PDF library capable of split…5.5
• CVE-2022-2486A vulnerability, which was classified as critical, was found…9.8
• CVE-2022-24860Databasir is a team-oriented relational database model docum…9.8
• CVE-2022-24861Databasir is a team-oriented relational database model docum…8.8
• CVE-2022-24862Databasir is a team-oriented relational database model docum…7.7
• CVE-2022-24864Origin Protocol is a blockchain based project. The Origin Pr…5.4
• CVE-2022-24865HumHub is an Open Source Enterprise Social Network. In affec…6.5
• CVE-2022-24866Discourse Assign is a plugin for assigning users to a topic …4.3
• CVE-2022-24867GLPI is a Free Asset and IT Management Software package, tha…7.5
• CVE-2022-24868GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-24869GLPI is a Free Asset and IT Management Software package, tha…5.4