swifturl github.com/apple/swift-nio-http2 vulnerabilities

Latest swifturl github.com/apple/swift-nio-http2 CVEs

Newest publication first

1. CVE-2026-28898 SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec

   Published 2026-06-25

   Medium·CVSS 5.3 EPSS 0.31%

   swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status)...

2. GHSA-xvr7-p2c6-j83w swift-nio-http2 affected by HTTP/2 MadeYouReset vulnerability

   Published 2025-08-13

   Medium·CVSS 6.3

   The HTTP/2 MadeYouReset vulnerability has a mild effect on swift-nio-http2. swift-nio-http2 mostly protects against MadeYouReset by using a number of existing denial-of-service prevention patterns that we added in response to the RapidReset vulnerabilities. The result is that ser...

3. CVE-2023-44487 HTTP/2 Stream Cancellation Attack

   Published 2023-10-10

   High·CVSS 7.5 EPSS 100.0% CISA KEV added 2023-10-10 Exploited in the wild Public exploit PoC

   The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

4. CVE-2022-0618 Denial of service via HTTP/2 HEADERS frames padding

   Published 2022-03-09

   High·CVSS 7.5 EPSS 1.3%

   A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSH_PROMISE frame where the frame contains padd...

5. CVE-2022-24668 swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames

   Published 2022-02-09

   High·CVSS 7.5 EPSS 1.1%

   A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after frame parsing but bef...

6. CVE-2022-24667 swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding

   Published 2022-02-09

   High·CVSS 7.5 EPSS 1.1%

   A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded header block. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. There are a number of implementation errors in the...

7. CVE-2022-24666 swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length

   Published 2022-02-09

   High·CVSS 7.5 EPSS 1.4%

   A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error when parsing a HT...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.