Advisory Database
  • Advisories
  • Dependency Scanning
  1. swift
  2. ›
  3. github.com/apple/swift-nio
  4. ›
  5. GHSA-mgc4-wqv7-4pxm

GHSA-mgc4-wqv7-4pxm: SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header

May 18, 2023

Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.

This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the NIOHTTP1 module.

References

  • github.com/advisories/GHSA-mgc4-wqv7-4pxm
  • github.com/apple/swift-nio
  • github.com/apple/swift-nio/commit/8da5c5a4e6c5084c296b9f39dc54f00be146e0fa
  • github.com/apple/swift-nio/commit/bfde40cac8eca25ce021552513b20ee23fc6e306
  • github.com/apple/swift-nio/commit/df9390006bce7da1b6273f804d3acbbfdfcc6154
  • github.com/apple/swift-nio/commit/f94b22b506e3557cb1b325534fa9bbcd39c90246
  • github.com/apple/swift-nio/pull/1387
  • github.com/apple/swift-nio/pull/1388
  • github.com/apple/swift-nio/security/advisories/GHSA-mgc4-wqv7-4pxm

Detect and mitigate GHSA-mgc4-wqv7-4pxm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 1.0.0 before 1.14.2, all versions starting from 2.0.0 before 2.13.1

Fixed versions

  • 1.14.2
  • 2.13.1

Solution

Upgrade to versions 1.14.2, 2.13.1 or above.

Impact 9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Source file

swift/github.com/apple/swift-nio/GHSA-mgc4-wqv7-4pxm.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:03 +0000.