TI-2019-06407 Aliases CVE-2019-8849 GHSA-frg3-gpcx-968f

Apple Swift-Ubuntu: A SwiftNIO application using TLS may be able to execute arbitrary code

MEDIUM 46Published 2019-12-18 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1. A SwiftNIO application using TLS may be able to execute arbitrary code.

Why it matters now

EPSS 0.0224 82nd percentileScored 2026-11-07

Fix Fixed Swift-Ubuntu (Apple): SwiftNIO SSL 2.4.1github.com/apple/swift-nio-ssl (SwiftURL): 2.4.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apple	Swift-Ubuntu	before SwiftNIO SSL 2.4.1	SwiftNIO SSL 2.4.1	Patch available	CNA
—	github.com/apple/swift-nio-ssl (SwiftURL)	2.0.0 to before 2.4.1	2.4.1	Patch available	GHSA-frg3-gpcx-968f

Swift-Ubuntu VendorApple Affected before SwiftNIO SSL 2.4.1 Fixed in SwiftNIO SSL 2.4.1 Patch available CNA
github.com/apple/swift-nio-ssl (SwiftURL) Vendor— Affected 2.0.0 to before 2.4.1 Fixed in 2.4.1 Patch available GHSA-frg3-gpcx-968f

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apple:swiftnio_ssl::::::::	before 2.4.1	Vulnerable	Apple

cpe:2.3:a:apple:swiftnio_ssl:*:*:*:*:*:*:*:* Versions before 2.4.1 Vulnerable ·Apple

Remediation

Fix · CNA Swift-Ubuntu (Apple) Fixed in SwiftNIO SSL 2.4.1
Fix · GHSA-frg3-gpcx-968f github.com/apple/swift-nio-ssl (SwiftURL) Fixed in 2.4.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2019-8849
2026-10-03 Alias added: GHSA-frg3-gpcx-968f

References

Advisory 2

Other 3

TI-2026-31909 Out-of-bounds read in Apple swift-nio-ssl CVSS 3.1HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences