GHSA-mgc4-wqv7-4pxm
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
Impact
Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.
This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the NIOHTTP1 module.
Workarounds
No workaround is available, users must upgrade.
References
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
Impact
Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.
This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the NIOHTTP1 module.
Workarounds
No workaround is available, users must upgrade.
References
- Record
GHSA-mgc4-wqv7-4pxm- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-444
- Updated
- 2026-11-02
OSV
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
Impact
Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.
This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the NIOHTTP1 module.
Workarounds
No workaround is available, users must upgrade.
References
- Record
GHSA-mgc4-wqv7-4pxm- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-444
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/apple/swift-nioSwiftURL | 1.0.0 up to 1.14.2 | 1.14.2 |
github.com/apple/swift-nioSwiftURL | 2.0.0 up to 2.13.1 | 2.13.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-mgc4-wqv7-4pxm is a critical vulnerability (CVSS 9.8) in github.com/apple/swift-nio, published May 18, 2023. No source lists public exploit code. Fixed in github.com/apple/swift-nio 1.14.2.
References
github.com/apple/swift-nio/security/advisories/GHSA-mgc4-wqv7-4pxm