swift-nio-http2: Missing CR/LF/NUL validation in header values

GHSA-q3g2-m552-3r9c CVE-2026-64785 MODERATE 3 days ago

## Summary SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1....

swift

No PRs yet

SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec

GHSA-4px2-pw77-vc85 CVE-2026-28898 MODERATE about 2 months ago

swift-nio-http2's HTTP/2-to-HTTP/1.1 codec (`HTTP2FramePayloadToHTTP1ServerCodec` / `HTTP2ToHTTP1ServerCodec`) did not validate pseudo-header value...

swift

No PRs yet

NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length

GHSA-6ph5-fww6-vfwv CVE-2026-28975 MODERATE about 2 months ago

### Impact When `NIOHTTPRequestDecompressor` is configured with `.ratio(N)`, the decompression limit is enforced using the `Content-Length` header...

swift

No PRs yet

SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS

GHSA-rj37-6j9x-74q6 CVE-2026-28980 HIGH about 2 months ago

### Summary The `HTTPDecoder` in `NIOHTTP1` enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fie...

swift

No PRs yet

SwiftNIO: Out-of-bounds write via ByteBuffer index and length UInt32 overflow

GHSA-r3rc-9hpw-54v9 CVE-2026-43671 HIGH about 2 months ago

### Summary A program using swift-nio is vulnerable to a potential out-of-bounds write when attacker-controlled index or length values exceeding `...

swift

No PRs yet

SwiftNIO: CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator

GHSA-cq87-8r7h-962v CVE-2026-28970 MODERATE about 2 months ago

Programs using swift-nio is vulnerable to HTTP request smuggling and HTTP response splitting attacks, caused by insufficient validation of outbound...

swift

No PRs yet

Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

GHSA-g3hp-f6mg-559v CVE-2026-47122 MODERATE about 2 months ago

## Summary AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection. ## Details `Aut...

swift

No PRs yet

Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

GHSA-hg88-v3cw-3qrh CVE-2026-47121 MODERATE about 2 months ago

## Summary Binary delta apply intermediate-symlink traversal in malicious .delta `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathCom...

swift

No PRs yet

container: pf Rule Injection via Domain Name Argument in `container system dns create --localhost` Command

GHSA-39g5-644c-qwcg LOW 3 months ago

#### Product Name: container Github Link: https://github.com/apple/container Version: <= 0.12.2 #### Summary The `container system dns creat...

swift

No PRs yet

CocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet Parsing

GHSA-r3fr-7m74-q7g2 CVE-2026-30867 MODERATE 4 months ago

A vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash ...

swift

No PRs yet

Swift Crypto: X-Wing HPKE Decapsulation Accepts Malformed Ciphertext Length

GHSA-9m44-rr2w-ppp7 CVE-2026-28815 HIGH 4 months ago

### Summary The X-Wing decapsulation path accepts attacker-controlled encapsulated ciphertext bytes without enforcing the required fixed ciphertex...

swift

10

Dependabot PRs

LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

GHSA-6jj5-j4j8-8473 CVE-2026-28499 MODERATE 4 months ago

### Summary LeafKit HTML-escaping is not working correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result...

swift

No PRs yet

Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

GHSA-4hfh-fch3-5q7p CVE-2026-27120 MODERATE 5 months ago

### Summary `htmlEscaped` in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing es...

swift

No PRs yet

Container and Containerization archive extraction does not guard against escapes from extraction base directory.

GHSA-cq3j-qj2h-6rv3 CVE-2026-20613 LOW 6 months ago

### Summary The `ArchiveReader.extractContents()` function used by `cctl image load` and container image load performs no pathname validation befor...

swift

No PRs yet

Swift W3C TraceContext vulnerable to a malformed HTTP header causing a crash

GHSA-mvpq-2v8x-ww6g CVE-2026-23886 MODERATE 6 months ago

### Impact A denial-of-service vulnerability due to improper input validation allows a remote attacker to crash the service via a malformed HTTP h...

swift

No PRs yet

jose-swift has JWT Signature Verification Bypass via None Algorithm

GHSA-88q6-jcjg-hvmw HIGH 7 months ago

### Summary An authentication bypass vulnerability allows any unauthenticated attacker to forge arbitrary JWT tokens by setting "alg": "none" in th...

swift

No PRs yet

AWS SDK for Swift adopted defense in depth enhancement for region parameter value

GHSA-pc9j-5v36-2mww LOW 7 months ago

CVSSv3.1 Rating: 3.7 (LOW) Summary This notification is related to the use of specific values for the region input field when calling AWS services...

swift

No PRs yet

swift-nio-http2 affected by HTTP/2 MadeYouReset vulnerability

GHSA-xvr7-p2c6-j83w MODERATE 12 months ago

The HTTP/2 [MadeYouReset vulnerability](https://galbarnahum.com/made-you-reset) has a mild effect on swift-nio-http2. swift-nio-http2 mostly prote...

swift

No PRs yet

Sparkle Signing Checks Bypass

GHSA-wc9m-r3v6-9p5h CVE-2025-0509 HIGH over 1 year ago

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Spark...

swift

No PRs yet

CVE-2025-0343: Swift ASN.1 can crash when parsing maliciously formed BER/DER

GHSA-w8xv-rwgf-4fwh CVE-2025-0343 LOW over 1 year ago

Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself whic...

swift

2

Dependabot PRs

wasm3 uncontrolled memory allocation vulnerability

GHSA-fmq6-4w57-2w3v CVE-2024-27529 MODERATE over 1 year ago

wasm3 at commit 139076a contains a memory leak in the Read_utf8 function.

cargo pypi swift

No PRs yet

Un-sanitized metric name or labels can be used to take over exported metrics

GHSA-x768-cvr2-345r CVE-2024-28867 MODERATE over 2 years ago

### Impact In code which applies _un-sanitized string values into metric names or labels_, like this: ```swift let lang = try? request.query-get(...

swift

No PRs yet

yyjson has a Double Free vulnerability

GHSA-whx6-m9j4-w2m2 CVE-2024-25713 HIGH over 2 years ago

### Summary The pool series allocator (pool_malloc/pool_free/pool_realloc) by yysjon has a Double Free vulnerability, which may lead to arbitrary ...

swift

No PRs yet

Vapor contains an integer overflow in URI leading to potential host spoofing

GHSA-r6r4-5pr8-gjcp CVE-2024-21631 MODERATE over 2 years ago

Vapor's `vapor_urlparser_parse` function uses `uint16_t` indexes when parsing a URI's components, which may cause integer overflows when parsing un...

swift

1

Dependabot PRs

Vapor's incorrect request error handling triggers server crash

GHSA-3mwq-h3g6-ffhm CVE-2023-44386 MODERATE almost 3 years ago

Vapor incorrectly handles errors encountered during parsing of HTTP 1.x requests, triggering a precondition failure in swift-nio due to API misuse ...

swift

No PRs yet

Path traversal in ZIPFoundation

GHSA-c2cc-3569-6jh2 CVE-2023-39138 HIGH almost 3 years ago

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.

swift

No PRs yet

Path traversal in Zip Swift

GHSA-g454-wj9r-jpg4 CVE-2023-39135 HIGH almost 3 years ago

An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry.

swift

No PRs yet

SwiftTerm Code Injection vulnerability

GHSA-jq43-q8mx-r7mq CVE-2022-23465 HIGH about 3 years ago

### Impact Attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user'...

swift

No PRs yet

Denial of Service via reachable assertion

GHSA-r6ww-5963-7r95 CVE-2022-24777 HIGH about 3 years ago

A grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This was due to incorrect logic when handling `GOAWAY` f...

swift

No PRs yet

Denial of service via HTTP/2 HEADERS frames padding

GHSA-q36x-r5x4-h4q6 CVE-2022-0618 HIGH about 3 years ago

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. Thi...

swift

No PRs yet

LeafKit allows XSS with untrusted user input

GHSA-rv3x-xq3r-8j9h CVE-2021-37634 MODERATE about 3 years ago

### Impact This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags ...

swift

No PRs yet

Incomplete Internal State Distinction in GRPCWebToHTTP2ServerCodec

GHSA-2jx2-qcm4-rf9h CVE-2021-36153 HIGH about 3 years ago

### Impact Affected gRPC Swift servers are vulnerable to precondition failures when parsing certain gRPC Web requests. This may lead to a denial o...

swift

No PRs yet

Uncontrolled Resource Consumption in LengthPrefixedMessageReader

GHSA-rxmj-hg9v-vp3p CVE-2021-36155 HIGH about 3 years ago

### Impact Affected gRPC Swift clients and servers are vulnerable to uncontrolled resource consumption attacks. Excessive memory may be allocated ...

swift

No PRs yet

Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash

GHSA-pqwh-c2f3-vxmq CVE-2021-32742 MODERATE about 3 years ago

### Impact A bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial o...

swift

No PRs yet

Vapor's Metrics integration could cause a system drain

GHSA-gcj9-jj38-hwmc CVE-2021-21328 MODERATE about 3 years ago

### Impact This is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app with the following attack vector: 1. send unli...

swift

No PRs yet

Arbitrary file read using percent-encoded relative paths in FileMiddleware

GHSA-vcvg-xgr8-p5gq CVE-2020-15230 MODERATE about 3 years ago

### Impact Attackers can access data at arbitrary filesystem paths on the same host as an application using `FileMiddleware`. ### Patches Versio...

swift

No PRs yet

Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware

GHSA-vj2m-9f5j-mpr5 CVE-2022-31005 HIGH about 3 years ago

Vapor is an HTTP web framework for Swift and [middleware](https://docs.vapor.codes/advanced/middleware/) is a logic chain between the client and a ...

swift

No PRs yet

Vapor vulnerable to denial of service in URLEncodedFormDecoder

GHSA-qvxg-wjxc-r4gg CVE-2022-31019 HIGH about 3 years ago

Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder. #...

swift

1

Dependabot PRs

Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder

GHSA-239c-6cv2-wwx8 CVE-2022-1642 HIGH about 3 years ago

### Impact A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producin...

swift

No PRs yet

SwiftNIO Extras vulnerable to improper detection of complete HTTP body decompression

GHSA-773g-x274-8qmf CVE-2022-3252 HIGH about 3 years ago

SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies. These two objects (`HTTPReques...

swift

No PRs yet

SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

GHSA-7fj7-39wj-c64f CVE-2022-3215 MODERATE about 3 years ago

`NIOHTTP1` and projects using it for generating HTTP responses, including SwiftNIO, can be subject to a HTTP Response Injection attack. This occurs...

swift

No PRs yet

Async HTTP Client has CRLF Injection vulnerability in HTTP request headers

GHSA-v3r5-pjpm-mwgq CVE-2023-0040 HIGH about 3 years ago

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability w...

swift

1

Dependabot PRs

Uncontrolled Recursion in HTTP2ToRawGRPCServerCodec

GHSA-4rhq-vq24-88gw CVE-2021-36154 MODERATE about 3 years ago

### Impact Affected gRPC Swift servers are vulnerable to uncontrolled recursion and stack consumption when parsing certain payloads. This may lead...

swift

No PRs yet

swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames

GHSA-pgfx-g6rc-8cjv CVE-2022-24668 HIGH about 3 years ago

A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack a...

swift

No PRs yet

swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length

GHSA-ccw9-q5h2-8c2w CVE-2022-24666 HIGH about 3 years ago

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. Thi...

swift

No PRs yet

SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header

GHSA-mgc4-wqv7-4pxm CRITICAL about 3 years ago

### Impact Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other ...

swift

No PRs yet

swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding

GHSA-w3f6-pc54-gfw7 CVE-2022-24667 HIGH about 3 years ago

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded hea...

swift

No PRs yet

PostgresNIO processes unencrypted bytes from man-in-the-middle

GHSA-9cfh-vx93-84vv CVE-2023-31136 LOW about 3 years ago

### Impact Any user of PostgresNIO connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses t...

swift

No PRs yet

zstd vulnerable to buffer overrun

GHSA-5c9c-6x87-f9vm CVE-2022-4899 HIGH over 3 years ago

A vulnerability was found in zstd v1.4.10, where an attacker can supply an empty string as an argument to the command line tool to cause buffer ove...

swift

No PRs yet

SwiftNIO SSL arbitrary code execution vulnerability

GHSA-frg3-gpcx-968f CVE-2019-8849 CRITICAL about 4 years ago

A SwiftNIO application using TLS may be able to execute arbitrary code. The issue was addressed by signaling that an executable stack is not requir...

swift

No PRs yet