{"id":"CVE-2026-43678","aliases":["EUVD-2026-63577","GHSA-qcc5-f287-vgmq"],"status":"published","description":"An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00374,"percentile":0.31699,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-770"],"published":"2026-08-20T18:57:03Z","modified":"2026-10-24T02:30:42Z","products":[{"vendor":"apple","product":"swift-nio"},{"vendor":"apple","product":"swiftnio"}],"references":[{"url":"https://github.com/apple/swift-nio/security/advisories/GHSA-qcc5-f287-vgmq","tags":["Vendor Advisory","advisory"]}],"sources":{"cve":[{"id":"CVE-2026-43678","description":"An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.","status":"published","published":"2026-08-20T18:57:03.222Z","modified":"2026-08-20T21:10:49.702Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-20","CWE-770"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-63577","description":"An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.","status":"published","published":"2026-08-20T18:57:03Z","modified":"2026-08-20T21:10:49Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:38.32409Z"}],"nvd":[{"id":"CVE-2026-43678","description":"An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.","status":"published","published":"2026-08-20T19:16:52.353Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-20","CWE-770"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"CVE-2026-43678","description":"An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.","status":"published","published":"2026-08-20T19:16:52.353Z","modified":"2026-10-24T02:30:42.157990124Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:04.820169Z"}]}}