Executive brief
Apple's swift-nio-http2 library, used for building high-performance networking applications in Swift, contains a vulnerability in how it converts modern HTTP/2 traffic into older HTTP/1.1 format. An attacker can send specially crafted web requests that "smuggle" hidden commands past security filters. This can lead to unauthorized access to data, bypass of security controls, or interference with other users' web sessions when the library is used in proxy or server environments.
Technical details
A request smuggling vulnerability exists in the HTTP2ToHTTP1Codec of swift-nio-http2. The codec fails to validate pseudo-header values (such as :path, :authority, and :method) for control characters like CR, LF, or NUL before translating them into HTTP/1.1 messages. Because HTTP/2 uses binary framing, these characters are passed transparently, but they act as delimiters when converted to the text-based HTTP/1.1 protocol. A remote, unauthenticated attacker can exploit this to inject headers or smuggle entire requests to backend servers. The issue is resolved in version 1.44.1 by adding validation at both the HPACK and translation layers.
Affected products
- Apple swift-nio-http2 < 1.44.1
Timeline
- 2026-05-21: disclosed: Advisory published by Apple on GitHub
- 2026-06-25: advisory: NVD publication date
- 2026-06-25: patched: Fix released in version 1.44.1