Apple Swift vulnerabilities

• apple swift-crypto A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5… CVE-2026-86983 5.9 MediumOctober 28, 2026
• apple swift-nio-ssh, swiftnio ssh +1 more A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulne… CVE-2026-43798 9.8 CriticalAugust 20, 2026
• apple swift-nio, swiftnio +1 more An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active con… CVE-2026-43678 5.3 MediumAugust 20, 2026
• apple swift-nio-http2, swiftnio http\/2 +1 more swift-nio-http2: Missing CR/LF/NUL validation in header values CVE-2026-64785 Fix available 5.3 MediumJuly 23, 2026
• apple swift-crypto Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update CVE-2026-43823 7.5 HighJuly 23, 2026
• apple swift-nio-ssl, swiftnio ssl +1 more NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by… CVE-2026-43820 7.7 HighJuly 23, 2026
• apple swift-nio-http2, swiftnio http\/2 +1 more SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec CVE-2026-28898 Fix available 5.3 MediumJune 12, 2026
• apple swift-crypto, macos +1 more Swift Crypto: X-Wing HPKE Decapsulation Accepts Malformed Ciphertext Length CVE-2026-28815 Fix available 7.5 HighApril 3, 2026
• apple swift prometheus, swift-server swift-prometheus +1 more Swift Prometheus un-sanitized metric name or labels can be used to take over exported metrics CVE-2024-28867 Fix available 5.9 MediumMarch 29, 2024
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• swift project foundation, apple swift foundation +1 more A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers. In this vulnerability, a client can insert one or several CRLF… CVE-2022-3918 8.8 HighJanuary 20, 2023
• apple swiftnio SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') CVE-2022-3215 Fix available 7.5 HighSeptember 28, 2022
• swift project swiftnio extras, apple swift-nio-extras +1 more SwiftNIO Extras vulnerable to improper detection of complete HTTP body decompression CVE-2022-3252 Fix available 7.5 HighSeptember 21, 2022
• apple swift, swift project corelib-foundation +1 more Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder CVE-2022-1642 Fix available 7.5 HighJune 16, 2022
• apple swiftnio http\/2, swift project swiftnio http2 +1 more Denial of service via HTTP/2 HEADERS frames padding CVE-2022-0618 Fix available 7.5 HighMarch 9, 2022
• apple swiftnio http\/2, swift project swiftnio http2 +1 more swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames CVE-2022-24668 Fix available 7.5 HighFebruary 9, 2022
• apple swiftnio http\/2, swift project swiftnio http2 +1 more swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding CVE-2022-24667 Fix available 7.5 HighFebruary 9, 2022
• apple swiftnio http\/2, swift project swiftnio http2 +1 more swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length CVE-2022-24666 Fix available 7.5 HighFebruary 9, 2022
• apple swift, swift 5.1.5 for linux +1 more A stack overflow issue existed in Swift for Linux. The issue was addressed with improved input... CVE-2020-9861 7.5 HighNovember 2, 2020
• apple swift, swift for ubuntu +1 more This issue was addresses by updating incorrect URLSession file descriptors management logic to... CVE-2019-8790 5.5 MediumOctober 27, 2020
• apple swiftnio ssl, swift-ubuntu +1 more SwiftNIO SSL arbitrary code execution vulnerability CVE-2019-8849 Fix available 9.8 CriticalDecember 18, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +15 more +17 more Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service CVE-2019-9518 Fix available EPSS 25.4% 7.5 HighAugust 13, 2019
• apache http server, traffic server, apple swiftnio +20 more +22 more Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service CVE-2019-9517 Fix available EPSS 27.0% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +16 more +18 more Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service CVE-2019-9516 Fix available EPSS 57.5% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +19 more +21 more Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service CVE-2019-9515 Fix available EPSS 87.3% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +25 more +27 more Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service CVE-2019-9514 Fix available EPSS 82.8% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +17 more +19 more Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service CVE-2019-9513 Public exploitFix available EPSS 81.6% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, debian linux +1 more +3 more Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service CVE-2019-9512 Fix available EPSS 83.4% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +17 more +19 more Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service CVE-2019-9511 Public exploitFix available EPSS 59.5% 7.5 HighAugust 13, 2019
• apple swiftnio In SwiftNIO before 1.8.0, a buffer overflow was addressed with improved size validation. CVE-2018-4281 9.8 CriticalJanuary 11, 2019
• apple swift An issue was discovered in certain Apple products. Swift before 4.1.1 Security Update 2018-001 is... CVE-2018-4220 8.8 HighJune 8, 2018