CVE-2026-28970: Apple SwiftNIO CRLF injection in HTTP validator handlers

Executive brief

SwiftNIO, a high-performance networking framework used in many Swift-based server applications, is vulnerable to a flaw that could allow attackers to interfere with web traffic. By injecting special characters into web addresses or server responses, an attacker could trick systems into processing fake requests or corrupting cached data. This could lead to security bypasses or the delivery of incorrect information to users.

Technical details

A CRLF injection vulnerability exists in SwiftNIO's NIOHTTPRequestHeadersValidator and NIOHTTPResponseHeadersValidator. These handlers failed to validate the request URI, request method, and response reason phrase, allowing control characters to be injected into the HTTP start line. An attacker can exploit this by influencing these fields—such as through a proxy forwarding attacker-controlled URIs or a malicious server triggering a redirect—to perform HTTP request smuggling or response splitting. This can result in WAF bypass or cache poisoning. The issue is fixed in version 2.100.0 by implementing strict RFC-compliant validation for these components.

Affected products

• Apple swift-nio >= 2.0.0, <= 2.99.0

Timeline

• 2026-05-21: disclosed: Initial disclosure to vendor
• 2026-06-12: advisory: GitHub Advisory published
• 2026-06-12: patched: Fix released in version 2.100.0

References

• https://api.github.com/users/kuranikaran
• https://github.com/kuranikaran
• https://api.github.com/users/kuranikaran/gists%7B/gist_id%7D
• https://api.github.com/users/kuranikaran/repos
• https://avatars.githubusercontent.com/u/85026744?v=4
• https://api.github.com/users/kuranikaran/events%7B/privacy%7D