Apple Swiftnio vulnerabilities

• apple swift-nio-ssh, swiftnio ssh +1 more A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulne… CVE-2026-43798 9.8 CriticalAugust 20, 2026
• apple swift-nio, swiftnio +1 more An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active con… CVE-2026-43678 5.3 MediumAugust 20, 2026
• apple swift-nio-http2, swiftnio http\/2 +1 more swift-nio-http2: Missing CR/LF/NUL validation in header values CVE-2026-64785 Fix available 5.3 MediumJuly 23, 2026
• apple swift-nio-ssl, swiftnio ssl +1 more NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by… CVE-2026-43820 7.7 HighJuly 23, 2026
• apple swift-nio-http2, swiftnio http\/2 +1 more SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec CVE-2026-28898 Fix available 5.3 MediumJune 12, 2026
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• apple swiftnio SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') CVE-2022-3215 Fix available 7.5 HighSeptember 28, 2022
• apple swiftnio http\/2, swift project swiftnio http2 +1 more Denial of service via HTTP/2 HEADERS frames padding CVE-2022-0618 Fix available 7.5 HighMarch 9, 2022
• apple swiftnio http\/2, swift project swiftnio http2 +1 more swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames CVE-2022-24668 Fix available 7.5 HighFebruary 9, 2022
• apple swiftnio http\/2, swift project swiftnio http2 +1 more swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding CVE-2022-24667 Fix available 7.5 HighFebruary 9, 2022
• apple swiftnio http\/2, swift project swiftnio http2 +1 more swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length CVE-2022-24666 Fix available 7.5 HighFebruary 9, 2022
• apple swiftnio ssl, swift-ubuntu +1 more SwiftNIO SSL arbitrary code execution vulnerability CVE-2019-8849 Fix available 9.8 CriticalDecember 18, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +15 more +17 more Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service CVE-2019-9518 Fix available EPSS 25.4% 7.5 HighAugust 13, 2019
• apache http server, traffic server, apple swiftnio +20 more +22 more Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service CVE-2019-9517 Fix available EPSS 27.0% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +16 more +18 more Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service CVE-2019-9516 Fix available EPSS 57.5% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +19 more +21 more Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service CVE-2019-9515 Fix available EPSS 87.3% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +25 more +27 more Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service CVE-2019-9514 Fix available EPSS 82.8% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +17 more +19 more Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service CVE-2019-9513 Public exploitFix available EPSS 81.6% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, debian linux +1 more +3 more Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service CVE-2019-9512 Fix available EPSS 83.4% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +17 more +19 more Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service CVE-2019-9511 Public exploitFix available EPSS 59.5% 7.5 HighAugust 13, 2019
• apple swiftnio In SwiftNIO before 1.8.0, a buffer overflow was addressed with improved size validation. CVE-2018-4281 9.8 CriticalJanuary 11, 2019