CVE-2026-64785
published 2026-07-23CVE-2026-64785: SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.29%
20.3th percentile
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | swift-nio-http2 | < 1.45.0 | 1.45.0 |
| apple | swift-nio-http2 | >= 0 < 1.45.0 | 1.45.0 |
| apple | swiftnio_http_2 | < 1.45.0 | 1.45.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
swift-nio-http2: SwiftNIO HTTP/2: HTTP Request Smuggling and Response Splitting via Incomplete Header Validation
vendor_redhat·2026-07-23·CVSS 5.3
CVE-2026-64785 [MEDIUM] CWE-93 swift-nio-http2: SwiftNIO HTTP/2: HTTP Request Smuggling and Response Splitting via Incomplete Header Validation
swift-nio-http2: SwiftNIO HTTP/2: HTTP Request Smuggling and Response Splitting via Incomplete Header Validation
A flaw was found in SwiftNIO HTTP/2. This vulnerability allows a remote attacker to perform HTTP request smuggling or response splitting. The issue stems from insufficient validation of incoming HTTP/2 HEADERS frames, which are parts of an HTTP/2 request. This allows special control characters, such as carriage return (CR) and line feed (LF), to reach an HTTP/1.1 backend, potentially bypassing security controls and enabling malicious manipulation of web requests or responses.
Statement: This vulnerability in SwiftNIO HTTP/2, which could lead to HTTP request smuggling or response splitting due to incomplete header validation, does not affect Red Hat products. Red Hat's analysis
GHSA
swift-nio-http2: Missing CR/LF/NUL validation in header values
ghsa·2026-07-24
CVE-2026-64785 [MEDIUM] CWE-113 swift-nio-http2: Missing CR/LF/NUL validation in header values
swift-nio-http2: Missing CR/LF/NUL validation in header values
## Summary
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let
CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend
through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling
or response splitting.
## Impact
Two related gaps in inbound header validation, against any application
using HTTP2ToHTTP1Codec (or HTTP2FramePayloadToHTTP1Codec) to front an
HTTP/1.1 backend:
Regular header field values were only checked against a forbidden-name
list (connection, transfer-encoding, proxy-connection, keep-alive,
upgrade); the value itself was never inspected. An attacker-controlled
regular header field value containing CR or LF passed validation and, once
serialized as `name: val
VulDB
Apple swift-nio-http2 up to 1.44.x HTTP/2 Codec response splitting
vuldb·2026-07-23
CVE-2026-64785 [CRITICAL] Apple swift-nio-http2 up to 1.44.x HTTP/2 Codec response splitting
A vulnerability has been found in Apple swift-nio-http2 up to 1.44.x and classified as critical. This affects an unknown part of the component HTTP2 Codec. Performing a manipulation results in http response splitting.
This vulnerability is identified as CVE-2026-64785. The attack can be initiated remotely. There is not any exploit available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
2026-07-23
Published