CVE-2026-64785: swift-nio-http2: Missing CR/LF/NUL validation in header values
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2’s HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting.
References
- github.com/advisories/GHSA-q3g2-m552-3r9c
- github.com/apple/swift-nio-http2/commit/45bdf670248be5f16ec0340e125dca285536f0fb
- github.com/apple/swift-nio-http2/commit/48bfd9067d7d1d15c4789440127a0cf36222ea43
- github.com/apple/swift-nio-http2/releases/tag/1.45.0
- github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c
- nvd.nist.gov/vuln/detail/CVE-2026-64785
Detect and mitigate CVE-2026-64785 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →