Skip to content
OpenAdvisories

Product · Apple

swift-nio-http2

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-64785

    swift-nio-http2: Missing CR/LF/NUL validation in header values

    SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerabili…

    Apple swift-nio-http2 swift-nio-http2 SwiftURL
  • Medium 5.3
    CVE-2026-28898

    SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec

    swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :…

    Apple swift-nio-http2 github.com/apple/swift-nio-http2 SwiftURL