Vulnerabilities

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the p…

NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack.

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.

In SwiftNIO before 1.8.0, a buffer overflow was addressed with improved size validation.