https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 00:06:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-224873 EUVD-2026-224873 https://cve.radiocsirt.org/vuln/euvd-2026-224873 https://cve.radiocsirt.org/vuln/fkie_cve-2024-28867 <p>Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string values into metric names or labels_, an attacker could make use of this and send a `?lang` query parameter containing newlines, `}` or similar characters which can lead to the attacker taking over the exported format -- including creating unbounded numbers of stored metrics, inflating server memory usage, or causing &#34;bogus&#34; metrics. This vulnerability is fixed in2.0.0-alpha.2.</p> <p>Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string values into metric names or labels_, an attacker could make use of this and send a `?lang` query parameter containing newlines, `}` or similar characters which can lead to the attacker taking over the exported format -- including creating unbounded numbers of stored metrics, inflating server memory usage, or causing &#34;bogus&#34; metrics. This vulnerability is fixed in2.0.0-alpha.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-28867 https://cve.radiocsirt.org/vuln/ghsa-x768-cvr2-345r <p><strong>Affected:</strong> SwiftURL: github.com/swift-server/swift-prometheus</p> <p>### Impact</p> <p>In code which applies _un-sanitized string values into metric names or labels_, like this:</p> <p>```swift let lang = try? request.query-get(String.self, at: &#34;lang&#34;) Counter ( label: &#34;language&#34;, dimensions: [(&#34;lang&#34;, lang ?? &#34;unknown&#34; )] ) ```</p> <p>an attacker could make use of this and send a `?lang` query parameter containing newlines, `}` or similar characters which can lead to the attacker taking over the exported format -- including creating unbounded numbers of stored metrics, inflating server memory usage, or causing &#34;bogus&#34; metrics.</p> <p>### Patches The default strategy to sanitize labels was moved deeper into the library, preventing illegal characters from appearing in name, label keys and values.</p> <p>Metric names and label names are now validated against the following requirement: `[a-zA-Z_:][a-zA-Z0-9_:]*` (for metric names) and `[a-zA-Z_][a-zA-Z0-9_]*` (for metric label names). Label values are not validated as they are allowed to contain any unicode characters. Developers _must_ validate labels themselves and not allow malicious input.</p> <p>The approach taken here mirrors the approach taken in the Go reference implementation.</p> <p>### Discussion</p> <p>It is **strongly discouraged** to use un-sanitized user input as names or labels in general, because they can lead to un-bounded growth of metrics, even as this vulnerability is patched and result in a Denial-of-Service attack opportunity -- **regardless** how well the library is sanitizing the inputs. We strongly recommend on…</p> <p><strong>Affected:</strong> SwiftURL: github.com/swift-server/swift-prometheus</p> <p>### Impact</p> <p>In code which applies _un-sanitized string values into metric names or labels_, like this:</p> <p>```swift let lang = try? request.query-get(String.self, at: &#34;lang&#34;) Counter ( label: &#34;language&#34;, dimensions: [(&#34;lang&#34;, lang ?? &#34;unknown&#34; )] ) ```</p> <p>an attacker could make use of this and send a `?lang` query parameter containing newlines, `}` or similar characters which can lead to the attacker taking over the exported format -- including creating unbounded numbers of stored metrics, inflating server memory usage, or causing &#34;bogus&#34; metrics.</p> <p>### Patches The default strategy to sanitize labels was moved deeper into the library, preventing illegal characters from appearing in name, label keys and values.</p> <p>Metric names and label names are now validated against the following requirement: `[a-zA-Z_:][a-zA-Z0-9_:]*` (for metric names) and `[a-zA-Z_][a-zA-Z0-9_]*` (for metric label names). Label values are not validated as they are allowed to contain any unicode characters. Developers _must_ validate labels themselves and not allow malicious input.</p> <p>The approach taken here mirrors the approach taken in the Go reference implementation.</p> <p>### Discussion</p> <p>It is **strongly discouraged** to use un-sanitized user input as names or labels in general, because they can lead to un-bounded growth of metrics, even as this vulnerability is patched and result in a Denial-of-Service attack opportunity -- **regardless** how well the library is sanitizing the inputs. We strongly recommend on…</p> https://cve.radiocsirt.org/vuln/ghsa-x768-cvr2-345r https://cve.radiocsirt.org/vuln/gsd-2024-28867 gsd-2024-28867 https://cve.radiocsirt.org/vuln/gsd-2024-28867