CVE-2026-28898
published 2026-06-25CVE-2026-28898: swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.19%
9.0th percentile
swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status) at both the HPACK header validation layer and the HTTP/2-to-HTTP/1.1 translation layer. Requests or responses containing CR, LF, or NUL bytes in any pseudo-header value are now rejected with a connection error. This issue is fixed in swift-nio-http2 1.44.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | swift-nio-http2 | < 1.44.1 | 1.44.1 |
| apple | swiftnio_http_2 | < 1.44.1 | 1.44.1 |
| github.com | apple_swift-nio-http2 | >= 0 < 1.44.1 | 1.44.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple swift-nio-http2 up to 1.44.0 Header Validation escape output (GHSA-4px2-pw77-vc85)
vuldb·2026-06-26·CVSS 5.3
CVE-2026-28898 [MEDIUM] Apple swift-nio-http2 up to 1.44.0 Header Validation escape output (GHSA-4px2-pw77-vc85)
A vulnerability was found in Apple swift-nio-http2 up to 1.44.0 and classified as critical. This vulnerability affects unknown code of the component Header Validation Handler. Executing a manipulation can lead to escaping of output.
The identification of this vulnerability is CVE-2026-28898. The attack may be launched remotely. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec
ghsa·2026-06-12
CVE-2026-28898 [LOW] CWE-444 SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec
SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec
swift-nio-http2's HTTP/2-to-HTTP/1.1 codec (`HTTP2FramePayloadToHTTP1ServerCodec` / `HTTP2ToHTTP1ServerCodec`) did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. A remote attacker could send an HTTP/2 request containing CR (\r), LF (\n), or NUL (\0) bytes in pseudo-header values such as `:path`, and when the server translated this to HTTP/1.1 — for example in a reverse-proxy configuration — the resulting output could contain injected headers or entirely smuggled requests.
This is an HTTP/2-to-HTTP/1.1 request smuggling vulnerability. HTTP/2's binary framing means that CRLF bytes are never parsed as line terminator
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-25
Published