{"id":"CVE-2026-64785","aliases":["EUVD-2026-48369","GHSA-q3g2-m552-3r9c"],"status":"published","title":"swift-nio-http2: Missing CR/LF/NUL validation in header values","description":"SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00289,"percentile":0.21688,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-113","CWE-444"],"published":"2026-07-23T18:50:40Z","modified":"2026-10-26T02:30:19Z","fixes":[{"ecosystem":"SwiftURL","package":"swift-nio-http2","fixed_in":["1.45.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"SwiftURL","package":"swift-nio-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.45.0"}]}]},{"source":"osv","ecosystem":"SwiftURL","package":"swift-nio-http2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.45.0"}]}]}],"products":[{"vendor":"apple","product":"swift-nio-http2"},{"vendor":"apple","product":"swiftnio_http\\/2"}],"references":[{"url":"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c","tags":["Vendor Advisory","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64785","tags":["advisory"]},{"url":"https://github.com/apple/swift-nio-http2/commit/45bdf670248be5f16ec0340e125dca285536f0fb","tags":["web"]},{"url":"https://github.com/apple/swift-nio-http2/commit/48bfd9067d7d1d15c4789440127a0cf36222ea43","tags":["web"]},{"url":"https://github.com/apple/swift-nio-http2/releases/tag/1.45.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q3g2-m552-3r9c"},{"url":"https://github.com/apple/swift-nio-http2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-64785","description":"SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.","status":"published","published":"2026-07-23T18:50:40.468Z","modified":"2026-07-24T20:06:58.518Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:19:57.818032Z"}],"euvd":[{"id":"EUVD-2026-48369","description":"SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.","status":"published","published":"2026-07-23T18:50:40Z","modified":"2026-07-24T20:06:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:38.612768Z"}],"ghsa":[{"id":"GHSA-q3g2-m552-3r9c","title":"swift-nio-http2: Missing CR/LF/NUL validation in header values","description":"## Summary\n\nSwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let\nCR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend\nthrough NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling\nor response splitting.\n\n## Impact\n\nTwo related gaps in inbound header validation, against any application\nusing HTTP2ToHTTP1Codec (or HTTP2FramePayloadToHTTP1Codec) to front an\nHTTP/1.1 backend:\n\nRegular header field values were only checked against a forbidden-name\nlist (connection, transfer-encoding, proxy-connection, keep-alive,\nupgrade); the value itself was never inspected. An attacker-controlled\nregular header field value containing CR or LF passed validation and, once\nserialized as `name: value CRLF` by the codec, terminated the field early\nand injected extra header lines into the outbound HTTP/1.1 message.\n\nPseudo-header values (`:path` in particular) were only checked against\nCR, LF and NUL. A `:path` value containing SP serializes into the\nrequest-target of `METHOD SP request-target SP HTTP-version CRLF`, so a\nvalue like `/a HTTP/1.1` produces `GET /a HTTP/1.1 HTTP/1.1` — a\nparser-differential request line depending on whether a downstream reader\ntakes the first or last SP-delimited token as the version.\n\nNeither of these is reachable on a stock pipeline: NIOHTTP1's outbound\nvalidator (`enableOutboundHeaderValidation`, on by default) already rejects\nthese characters on write. The exposure is pipelines that skip outbound\nvalidation, or any code that reads validated-looking `HTTPRequestHead.headers`\nand forwards the values on trusting that HTTP/2 already checked them.\n\n## Fix\n\nFixed in 48bfd90 and 45bdf67.\n\n## Mitigation\n\nUpgrade to 1.45.0","status":"published","published":"2026-07-24T21:52:10Z","modified":"2026-07-24T21:52:11Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-113","CWE-444"],"updated_at":"2026-11-02T14:40:53.707378Z"}],"nvd":[{"id":"CVE-2026-64785","description":"SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.","status":"published","published":"2026-07-23T20:17:21.44Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"CVE-2026-64785","description":"SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.","status":"published","published":"2026-07-23T20:17:21.44Z","modified":"2026-10-26T02:30:19.819551936Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:14.096824Z"},{"id":"GHSA-q3g2-m552-3r9c","title":"swift-nio-http2: Missing CR/LF/NUL validation in header values","description":"## Summary\n\nSwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let\nCR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend\nthrough NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling\nor response splitting.\n\n## Impact\n\nTwo related gaps in inbound header validation, against any application\nusing HTTP2ToHTTP1Codec (or HTTP2FramePayloadToHTTP1Codec) to front an\nHTTP/1.1 backend:\n\nRegular header field values were only checked against a forbidden-name\nlist (connection, transfer-encoding, proxy-connection, keep-alive,\nupgrade); the value itself was never inspected. An attacker-controlled\nregular header field value containing CR or LF passed validation and, once\nserialized as `name: value CRLF` by the codec, terminated the field early\nand injected extra header lines into the outbound HTTP/1.1 message.\n\nPseudo-header values (`:path` in particular) were only checked against\nCR, LF and NUL. A `:path` value containing SP serializes into the\nrequest-target of `METHOD SP request-target SP HTTP-version CRLF`, so a\nvalue like `/a HTTP/1.1` produces `GET /a HTTP/1.1 HTTP/1.1` — a\nparser-differential request line depending on whether a downstream reader\ntakes the first or last SP-delimited token as the version.\n\nNeither of these is reachable on a stock pipeline: NIOHTTP1's outbound\nvalidator (`enableOutboundHeaderValidation`, on by default) already rejects\nthese characters on write. The exposure is pipelines that skip outbound\nvalidation, or any code that reads validated-looking `HTTPRequestHead.headers`\nand forwards the values on trusting that HTTP/2 already checked them.\n\n## Fix\n\nFixed in 48bfd90 and 45bdf67.\n\n## Mitigation\n\nUpgrade to 1.45.0","status":"published","published":"2026-07-24T21:52:10Z","modified":"2026-07-24T22:11:43.421919Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-113","CWE-444"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}