CVE-2026-64785
Received Received - Intake

HTTP/2 Header Injection in SwiftNIO

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Apple Inc.

Description
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-24
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-64785
EUVD
EUVD-2026-48369

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apple swift_nio_http2 1.45.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves SwiftNIO HTTP/2 versions before 1.45.0 lacking proper validation for inbound HEADERS frames. Control characters like CR, LF, NUL, SP, and others could pass through to an HTTP/1.1 backend when using NIOHTTP2's HTTP/2-to-HTCP/1 codec. This allows HTTP request smuggling or response splitting attacks.

Detection Guidance

Detecting this vulnerability requires checking the version of SwiftNIO HTTP/2 in use. If your system uses a version before 1.45.0, it is vulnerable. Commands like 'swift package show-dependencies' or inspecting package manifests can help verify the version.

Impact Analysis

An attacker could exploit this by injecting CR or LF into header values, causing malformed HTTP/1.1 messages. This may lead to request smuggling or response splitting, potentially bypassing security controls or manipulating responses.

Mitigation Strategies

Upgrade SwiftNIO HTTP/2 to version 1.45.0 or later. This version includes the necessary validation to prevent control characters from reaching the HTTP/1.1 backend. Ensure outbound validation is enabled in your configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64785. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart