Baarde

**Name of the Vulnerable Software and Affected Versions** Swift ASN.1 (affected versions not specified) **Description** The issue is caused by a confusion in the ASN.1 library, which assumes that certain objects can only be provided in either constructed or primitive forms. This can trigger a `preconditionFailure` if the constraint is not met. The impact of this is that it can be used as a denial-of-service vector when parsing BER/DER data from unknown sources, such as when parsing TLS certificates. There is no memory-safety issue, and the crash is a graceful one from the Swift runtime. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vapor versions prior to 4.90.0 **Description** Vapor is an HTTP web framework for Swift. The `vapor urlparser parse` function uses `uint16 t` indexes when parsing a URI's components, which may cause integer overflows when parsing untrusted inputs. This issue does not affect Vapor directly but could impact applications relying on the URI type for validating user input. The URI type is used in several places in Vapor, and a developer may decide to use URI to represent a URL in their application, especially if that URL is then passed to the HTTP Client, and rely on its public properties and methods. However, URI may fail to properly parse a valid (albeit abnormally long) URL, due to string ranges being converted to 16-bit integers. An attacker may use this behavior to trick the application into accepting a URL to an untrusted destination. By padding the port number with zeros, an attacker can cause an integer overflow to occur when the URL authority is parsed and, as a result, spoof the host. **Recommendations** For versions prior to 4.90.0, update to version 4.90.0 to resolve the issue. As a temporary workaround, validate user input before parsing as a URI or, if possible, use Foundation's `URL` and `URLComponents` utilities.