Descripción
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2-s HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.
CVSS 5.3EPSS 0.181%Riesgo 0.54
Ver fuente- Publicación
- 2026-07-23 20:17:21
- Versiones afectadas
- <1.45.0
- Tipo
- Librería
- Última modificación
- 2026-07-24 21:16:45
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N