Read the docs
TI-2020-07937 Aliases CVE-2020-9861GHSA-g4pr-mpxh-7vhq

Uncontrolled recursion in Swift 5.1.5 for Linux

Priority LOW 36CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-674.

Summary

A stack overflow issue existed in Swift for Linux. The issue was addressed with improved input validation for dealing with deeply nested malicious JSON input.

Why it matters now

EPSS 0.0145 73rd percentileScored 2026-11-07
Fix Fixed Swift 5.1.5 for Linux (Swift): Swift 5.1.5 for Linux

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SwiftSwift 5.1.5 for Linuxbefore Swift 5.1.5 for LinuxSwift 5.1.5 for LinuxPatch availableCNA
  • Swift 5.1.5 for Linux VendorSwift Affected before Swift 5.1.5 for Linux Fixed in Swift 5.1.5 for Linux Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apple:swift:*:*:*:*:*:ubuntu:*:*up to 5.1.4VulnerableApple
  • cpe:2.3:a:apple:swift:*:*:*:*:*:ubuntu:*:* Versions up to 5.1.4 Vulnerable ·Apple

Remediation

  • Fix · CNA Swift 5.1.5 for Linux (Swift) Fixed in Swift 5.1.5 for Linux

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat JBoss Fuse 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-9861
  2. 2026-10-03 Alias added: GHSA-g4pr-mpxh-7vhq

References

Advisory 1

  • TI-2026-65766 Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path CVSS 3.1CRITICAL 9.3
  • TI-2020-07917 In SwiftNIO Extras before 1.4.1, a logic issue was addressed with improved restrictions. CVSS 3.1HIGH 7.5
  • TI-2018-11744 An issue was discovered in SWIFT Alliance Web Platform 7.1.23. CVSS 3.0HIGH 7.5
  • TI-2025-04722 Conference Scheduler <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences