medium5.3
CVE-2026-64785
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTT…
Impact
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| swift | swift-nio-http2 | < 1.45.0 | 1.45.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Swiftnio Http\/2 | before 1.45.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-q3g2-m552-3r9c
- https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c
- https://nvd.nist.gov/vuln/detail/CVE-2026-64785
- https://github.com/apple/swift-nio-http2/commit/45bdf670248be5f16ec0340e125dca285536f0fb
- https://github.com/apple/swift-nio-http2/commit/48bfd9067d7d1d15c4789440127a0cf36222ea43
- https://github.com/apple/swift-nio-http2/releases/tag/1.45.0