Detections
Analytics
SCA: security update for github.com/swaggo/http-swagger (GHSA-xg75-q3q5-cqmv)
high Tenable Cloud Security Plugin ID 420480
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger
2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack
consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper
handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path
prefix to the "GET" method as a workaround. (CVE-2022-24863)
See Also
Plugin Details
Severity: High
ID: 420480
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2022-24863
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 4/22/2022
Vulnerability Publication Date: 4/18/2022
Reference Information
CVE: CVE-2022-24863