{"id":"CVE-2019-8849","aliases":["EUVD-2022-3826","GHSA-frg3-gpcx-968f"],"status":"published","title":"SwiftNIO SSL arbitrary code execution vulnerability","description":"The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1. A SwiftNIO application using TLS may be able to execute arbitrary code.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0224,"percentile":0.82949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-12-18T17:33:24Z","modified":"2026-10-24T14:06:55Z","fixes":[{"ecosystem":"SwiftURL","package":"github.com/apple/swift-nio-ssl","fixed_in":["2.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"SwiftURL","package":"github.com/apple/swift-nio-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.1"}]}]},{"source":"osv","ecosystem":"SwiftURL","package":"github.com/apple/swift-nio-ssl","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.4.1"}]}]}],"products":[{"vendor":"apple","product":"swift-ubuntu"},{"vendor":"apple","product":"swiftnio_ssl"}],"references":[{"url":"https://support.apple.com/HT210772","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8849","tags":["advisory"]},{"url":"https://github.com/apple/swift-nio-ssl/commit/109faef770994e71b6bafcc015e2e96b88a4af8c","tags":["web"]},{"url":"https://github.com/apple/swift-nio-ssl/releases/tag/2.4.1","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-COCOAPODS-SWIFTNIOSSL-8492737","tags":["web"]},{"url":"https://github.com/advisories/GHSA-frg3-gpcx-968f"},{"url":"https://github.com/apple/swift-nio-ssl","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-8849","description":"The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1. A SwiftNIO application using TLS may be able to execute arbitrary code.","status":"published","published":"2019-12-18T17:33:24Z","modified":"2024-08-04T21:31:37.467Z","updated_at":"2026-11-02T14:20:22.019351Z"}],"euvd":[{"id":"EUVD-2022-3826","description":"The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1. A SwiftNIO application using TLS may be able to execute arbitrary code.","status":"published","published":"2019-12-18T17:33:24Z","modified":"2024-08-04T21:31:37Z","updated_at":"2026-11-03T03:06:40.408517Z"}],"ghsa":[{"id":"GHSA-frg3-gpcx-968f","title":"SwiftNIO SSL arbitrary code execution vulnerability","description":"A SwiftNIO application using TLS may be able to execute arbitrary code. The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1.","status":"published","published":"2022-05-24T17:04:41Z","modified":"2025-08-05T15:41:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:38:52.85141Z"}],"nvd":[{"id":"CVE-2019-8849","description":"The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1. A SwiftNIO application using TLS may be able to execute arbitrary code.","status":"published","published":"2019-12-18T18:15:44.99Z","modified":"2026-06-17T02:42:43.523Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:05:40.856496Z"}],"osv":[{"id":"CVE-2019-8849","description":"The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1. A SwiftNIO application using TLS may be able to execute arbitrary code.","status":"published","published":"2019-12-18T18:15:44.99Z","modified":"2026-10-24T14:06:55.848488198Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"GHSA-frg3-gpcx-968f","title":"SwiftNIO SSL arbitrary code execution vulnerability","description":"A SwiftNIO application using TLS may be able to execute arbitrary code. The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1.","status":"published","published":"2022-05-24T17:04:41Z","modified":"2025-08-04T14:23:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}