medium5.3
CVE-2026-28898
swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 messag…
Impact
swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status) at both the HPACK header validation layer and the HTTP/2-to-HTTP/1.1 translation layer. Requests or responses containing CR, LF, or NUL bytes in any pseudo-header value are now rejected with a connection error. This issue is fixed in swift-nio-http2 1.44.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| swift | github.com/apple/swift-nio-http2 | < 1.44.0 | 1.44.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Swiftnio Http\/2 | before 1.44.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-4px2-pw77-vc85
- https://github.com/apple/swift-nio-http2/security/advisories/GHSA-4px2-pw77-vc85
- https://nvd.nist.gov/vuln/detail/CVE-2026-28898
- https://github.com/apple/swift-nio-http2/commit/61d1b44f6e4e118792be1cff88ee2bc0267c6f9a