CVE-2026-64785
published 2026-07-23CVE-2026-64785: SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.18%
7.9th percentile
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | swift-nio-http2 | < 1.45.0 | 1.45.0 |
| apple | swift-nio-http2 | >= 0 < 1.45.0 | 1.45.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
swift-nio-http2: Missing CR/LF/NUL validation in header values
ghsa·2026-07-24
CVE-2026-64785 [MEDIUM] CWE-113 swift-nio-http2: Missing CR/LF/NUL validation in header values
swift-nio-http2: Missing CR/LF/NUL validation in header values
## Summary
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let
CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend
through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling
or response splitting.
## Impact
Two related gaps in inbound header validation, against any application
using HTTP2ToHTTP1Codec (or HTTP2FramePayloadToHTTP1Codec) to front an
HTTP/1.1 backend:
Regular header field values were only checked against a forbidden-name
list (connection, transfer-encoding, proxy-connection, keep-alive,
upgrade); the value itself was never inspected. An attacker-controlled
regular header field value containing CR or LF passed validation and, once
serialized as `name: val
VulDB
Apple swift-nio-http2 up to 1.44.x HTTP/2 Codec response splitting
vuldb·2026-07-23
CVE-2026-64785 [CRITICAL] Apple swift-nio-http2 up to 1.44.x HTTP/2 Codec response splitting
A vulnerability has been found in Apple swift-nio-http2 up to 1.44.x and classified as critical. This affects an unknown part of the component HTTP2 Codec. Performing a manipulation results in http response splitting.
This vulnerability is identified as CVE-2026-64785. The attack can be initiated remotely. There is not any exploit available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-23
Published