Read the docs
TI-2026-23083 Aliases CVE-2026-28898GHSA-4px2-pw77-vc85

Improper output encoding in Apple swift-nio-http2

Priority LOW 30CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status) at both the HPACK header validation layer and the HTTP/2-to-HTTP/1.1 translation layer. Requests or responses containing CR, LF, or NUL bytes in any pseudo-header value are now rejected with a connection error. This issue is fixed in swift-nio-http2 1.44.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 24th percentileScored 2026-11-07
Fix Fixed swift-nio-http2 (Apple): 1.44.1github.com/apple/swift-nio-http2 (SwiftURL): 1.44.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Appleswift-nio-http2before 1.44.11.44.1Patch availableCNA
—github.com/apple/swift-nio-http2 (SwiftURL)before 1.44.01.44.0Patch availableGHSA-4px2-pw77-vc85
  • swift-nio-http2 VendorApple Affected before 1.44.1 Fixed in 1.44.1 Patch available CNA
  • github.com/apple/swift-nio-http2 (SwiftURL) Vendor— Affected before 1.44.0 Fixed in 1.44.0 Patch available GHSA-4px2-pw77-vc85

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apple:swiftnio_http\/2:*:*:*:*:*:swift:*:*before 1.44.1VulnerableApple
  • cpe:2.3:a:apple:swiftnio_http\/2:*:*:*:*:*:swift:*:* Versions before 1.44.1 Vulnerable ·Apple

Remediation

  • Fix · CNA swift-nio-http2 (Apple) Fixed in 1.44.1
  • Fix · GHSA-4px2-pw77-vc85 github.com/apple/swift-nio-http2 (SwiftURL) Fixed in 1.44.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28898
  2. 2026-10-03 Alias added: GHSA-4px2-pw77-vc85

References

Advisory 2

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2022-08484 A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a… CVSS 3.1HIGH 7.5
  • TI-2022-08486 A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a… CVSS 3.1HIGH 7.5
  • TI-2022-08485 Integer overflow in Apple SwiftNIO HTTP2 CVSS 3.1HIGH 7.5
  • TI-2022-00535 A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a… CVSS 3.1HIGH 7.5
  • TI-2026-46317 HTTP response splitting in Apple swift-nio-http2 CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences