CVE-2026-64785

Published: Jul 23, 2026Modified: Sep 1, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.

Affected (1)

Products: Apple: Swiftnio Http/2

1 product

Swiftnio Http/2

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Swiftnio Http/2	Before 1.45.0

Related CWEs

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (1)

https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c

Source: product-security@apple.com

Vendor AdvisoryPatch

Timeline

No history available yet.