CVE-2025-0343: Swift ASN.1 Denial-of-Service Vulnerability in Parsing BER/DER
Summary
CVE-2025-0343: CVE-2025-0343: Swift ASN.1 can crash when parsing maliciously formed BER/DER. Affects github.com/apple/swift-asn1 versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Swift ASN.1 library is designed to handle Abstract Syntax Notation One (ASN.1) encoding, which is widely used in various protocols, including TLS. This library supports both Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER) for data serialization. However, it has a vulnerability that can lead to crashes when parsing malformed BER/DER data, particularly from untrusted sources.
Vulnerability Detail
CVE-2025-0343 arises from a flaw in the Swift ASN.1 library where it incorrectly assumes that certain ASN.1 objects can only be provided in either constructed or primitive forms. This assumption leads to a preconditionFailure crash when the constraint is violated. While this does not pose a memory safety issue, it can be exploited as a denial-of-service vector, particularly when parsing data from unknown sources, such as TLS certificates. The vulnerability is classified under CWE-228, indicating a potential for unexpected behavior due to incorrect assumptions in the code.
How To Fix
Minimum fixed version
1.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to ensure that only trusted and well-formed BER/DER data is processed. This can help mitigate the risk of triggering the vulnerability while a permanent fix is being applied.
Conclusion
CVE-2025-0343 is a significant vulnerability in the Swift ASN.1 library that can lead to denial-of-service attacks when parsing malformed BER/DER data. It is crucial to update to the patched version 1.3.1 or later and to implement input validation as a temporary measure. Utilizing tools like Vulert can further enhance your application's security by monitoring for vulnerabilities.
See every vulnerability recorded for github.com/apple/swift-asn1 →
FAQ
CVE-2025-0343 is a vulnerability in the Swift ASN.1 library that can cause crashes when parsing malformed BER/DER data.
If your application uses the Swift ASN.1 library to parse data from untrusted sources, it may be susceptible to denial-of-service attacks due to this vulnerability.
Yes, the vulnerability has been patched in version 1.3.1 of the Swift ASN.1 library. It is recommended to update to this version or later.
Implement input validation to restrict the parsing of untrusted BER/DER data until you can apply the update.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time without needing to install any software.
