# Vapor 4.40.1: Denial Of Service Vulnerability in the metrics integration

**URL:** <https://forums.swift.org/t/vapor-4-40-1-denial-of-service-vulnerability-in-the-metrics-integration/44985>\
**Category:** Security Updates\
**Created:** [February 22, 2021, 4:45pm UTC](https://forums.swift.org/t/vapor-4-40-1-denial-of-service-vulnerability-in-the-metrics-integration/44985 "2021-02-22T16:45:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![0xTim](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/0xtim/32/27968_2.png) [@0xTim](https://forums.swift.org/u/0xTim)\
**Post date:** [February 22, 2021, 4:45pm UTC](https://forums.swift.org/t/vapor-4-40-1-denial-of-service-vulnerability-in-the-metrics-integration/44985/1 "2021-02-22T16:45:23Z")

</div>

In Vapor version's before 4.40.1, there was a vulnerability in Vapor's Swift Metrics integration. An attacker could send multiple requests to bad routes which would create multiple counters and timers. This could potentially drain the system as well as affecting downstream systems.

You should upgrade to 4.40.1 if you're bootstrapping a metrics system.

Details can be found on GitHub under [Vapor's security advisories](https://github.com/vapor/vapor/security/advisories/GHSA-gcj9-jj38-hwmc). A CVE has been requested and will be added here once issued.

---

<div class="post-metadata">

**Author:** ![0xTim](https://sea2.discourse-cdn.com/swift/user_avatar/forums.swift.org/0xtim/32/27968_2.png) [@0xTim](https://forums.swift.org/u/0xTim)\
**Post date:** [February 26, 2021, 10:55am UTC](https://forums.swift.org/t/vapor-4-40-1-denial-of-service-vulnerability-in-the-metrics-integration/44985/2 "2021-02-26T10:55:09Z")

</div>

CVE-2021-21328 has now been issued