CVE-2026-28898 Details
Description
swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status) at both the HPACK header validation layer and the HTTP/2-to-HTTP/1.1 translation layer. Requests or responses containing CR, LF, or NUL bytes in any pseudo-header value are now rejected with a connection error. This issue is fixed in swift-nio-http2 1.44.1.
A request smuggling vulnerability has been identified in the Swift NIO HTTP/2 library, specifically in versions prior to 1.44.1. The issue arises in the HTTP/2-to-HTTP/1.1 codec, which failed to validate pseudo-header values for control characters before translating them into HTTP/1.1 messages. This lack of validation allowed remote attackers to inject CR, LF, or NUL bytes into pseudo-headers such as ':path', which could then be smuggled through to HTTP/1.1 responses. Servers using this codec to translate HTTP/2 requests to HTTP/1.1, particularly in reverse-proxy configurations with frameworks like Vapor, are affected.
Users are advised to upgrade to Swift NIO HTTP/2 version 1.44.1 or later, where this vulnerability has been addressed by adding validation to all pseudo-header values. Instructions for upgrading can be found in the Swift NIO HTTP/2 GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/advisories/GHSA-4px2-pw77-vc85 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| apple swiftnio http/2 | < 1.44.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |