Skip to content
OpenAdvisories

Package · SwiftURL

github.com/apple/swift-nio-http2

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 5.3
    CVE-2026-28898

    SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec

    swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :…

    Apple swift-nio-http2 github.com/apple/swift-nio-http2 SwiftURL
  • Medium —
    GHSA-xvr7-p2c6-j83w

    swift-nio-http2 affected by HTTP/2 MadeYouReset vulnerability

    The HTTP/2 [MadeYouReset vulnerability](https://galbarnahum.com/made-you-reset) has a mild effect on swift-nio-http2. swift-nio-http2 mostly protects against MadeYouReset by using a number of existing denial-of-service prevention patterns that we added in res…

    github.com/apple/swift-nio-http2 SwiftURL
  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs go dotnet7 trafficserver Debian Ubuntu Alpine Maven Go SwiftURL
    KEV Oct 10, 2023
  • High 7.5
    CVE-2022-0618

    Denial of service via HTTP/2 HEADERS frames padding

    A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSH_PROMISE frame where th…

    Swift Project SwiftNIO HTTP2 github.com/apple/swift-nio-http2 SwiftURL
  • High 7.5
    CVE-2022-24668

    swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames

    A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after …

    Swift Project SwiftNIO HTTP2 github.com/apple/swift-nio-http2 SwiftURL
  • High 7.5
    CVE-2022-24667

    swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding

    A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded header block. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. There are a number of implemen…

    Swift Project SwiftNIO HTTP2 github.com/apple/swift-nio-http2 SwiftURL
  • High 7.5
    CVE-2022-24666

    swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length

    A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical er…

    Swift Project SwiftNIO HTTP2 github.com/apple/swift-nio-http2 SwiftURL