Users of Hummingbird should update to version 2.26.0 now. It includes fixes for the following security advisories
Unbounded recursion in URLEncodedFormDecoder allows stack exhaustion
It is possible for an attacker to construct a URL encoded form HTTP request that will cause a Hummingbird application using URLEncodedFormDecoder to crash via stack exhaustion. When decoding URL encoded form requests URLEncodedFormDecoder creates an intermediate node tree that is built using a recursive function. There is no nesting-depth limit to the number of form field keys, so it is possible to construct a URL encoded form that will cause a fatal crash from stack exhaustion.
Reachable assertion in FileMiddleware Range header parsing
It is possible for an attacker to construct a HTTP Range header that will cause a Hummingbird application using FileMiddlewareto crash. The FileMiddleware constructs a Swift ClosedRange<Int> from the "Range" header without verifying the lower bound is less than or equal to the upper bound. A "Range" header where the lower bound is greater than the upper bound eg Range: bytes=5-2 will cause a precondition in the ClosedRange initialiser and abort the application process.
UTF8 character parsing of header fields crashing the server process
It is possible for an attacker to construct a HTTP Range or Content-Type header with extended UTF8 characters that will cause a Hummingbird application to crash. There is a logic error in the parsing of UTF8 characters that will cause an out of bounds read when parsing specific Unicode characters. An out of bounds read in Swift causes an exception and the application process exits.
Unfortunately none of these advisories have CVE IDs yet as GitHub has a massive backlog of security advisories to review.
Thank you to @tiny0boy for reporting the first two issues, and to @nesevis for reporting the last one.