CVE-2026-64785

Awaiting Analysis Awaiting Analysis - Queue

HTTP/2 Header Injection in SwiftNIO

Publication date: 2026-07-23

Last updated on: 2026-07-24

Assigner: Apple Inc.

Description

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-24

Generated

2026-08-13

AI Q&A

2026-07-23

EPSS Evaluated

2026-08-11

NVD

CVE-2026-64785

EUVD

EUVD-2026-48369

Affected Vendors & Products

Vendor	Product	Version / Range
apple	swift-nio-http2	1.45.0
apple	swift_nio_http2	1.45.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability involves SwiftNIO HTTP/2 versions before 1.45.0 lacking proper validation for inbound HEADERS frames. Control characters like CR, LF, NUL, SP, and others could pass through to an HTTP/1.1 backend when using NIOHTTP2's HTTP/2-to-HTCP/1 codec. This allows HTTP request smuggling or response splitting attacks.

Detection Guidance

Detecting this vulnerability requires checking the version of SwiftNIO HTTP/2 in use. If your system uses a version before 1.45.0, it is vulnerable. Commands like 'swift package show-dependencies' or inspecting package manifests can help verify the version.

Impact Analysis

An attacker could exploit this by injecting CR or LF into header values, causing malformed HTTP/1.1 messages. This may lead to request smuggling or response splitting, potentially bypassing security controls or manipulating responses.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling HTTP request smuggling or response splitting attacks. Such attacks may lead to unauthorized data access, manipulation, or disclosure, which are critical violations under these regulations. Organizations using affected versions of SwiftNIO HTTP/2 may face increased risk of data breaches, affecting their compliance status.

Mitigation Strategies

Upgrade SwiftNIO HTTP/2 to version 1.45.0 or later. This version includes the necessary validation to prevent control characters from reaching the HTTP/1.1 backend. Ensure outbound validation is enabled in your configuration.

Hi! I’m here to help you understand CVE-2026-64785. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70