# CVE-2026-28970: Apple SwiftNIO CRLF injection in HTTP validator handlers

Source: https://junglewise.ai/threats/cve-2026-28970-apple-swiftnio-crlf-injection-in-http-validator-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-28970 · Severity: medium · CVSS 6.3 · Published 2026-06-12

SwiftNIO, a high-performance networking framework used in many Swift-based server applications, is vulnerable to a flaw that could allow attackers to interfere with web traffic. By injecting special characters into web addresses or server responses, an attacker could trick systems into processing fake requests or corrupting cached data. This could lead to security bypasses or the delivery of incorrect information to users.

Technologies: [Apple SwiftNIO](https://junglewise.ai/threats/technologies/swiftnio), [github.com/apple/swift-nio (Swift)](https://junglewise.ai/threats/technologies/github-com-apple-swift-nio). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple), [Swift](https://junglewise.ai/threats/vendors/swift).

## Quick answers

**Is CVE-2026-28970 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28970 being exploited in the wild.

**How severe is CVE-2026-28970?** Medium severity, with a CVSS score of 6.3, published 12 June 2026.

**Which products and versions are affected?** github.com/apple/swift-nio (Swift) >= 2.0.0, <= 2.99.0.

**Is there a fix for CVE-2026-28970?** A patch was published on 2026-06-12: Fix released in version 2.100.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28970 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-28970?** Check whether you run Apple SwiftNIO or github.com/apple/swift-nio (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CRLF injection vulnerability exists in SwiftNIO's NIOHTTPRequestHeadersValidator and NIOHTTPResponseHeadersValidator. These handlers failed to validate the request URI, request method, and response reason phrase, allowing control characters to be injected into the HTTP start line. An attacker can exploit this by influencing these fields—such as through a proxy forwarding attacker-controlled URIs or a malicious server triggering a redirect—to perform HTTP request smuggling or response splitting. This can result in WAF bypass or cache poisoning. The issue is fixed in version 2.100.0 by implementing strict RFC-compliant validation for these components.

## Affected products

- Apple swift-nio >= 2.0.0, <= 2.99.0

## Identifiers

- CVE-2026-28970
- GHSA-cq87-8r7h-962v

## Timeline

- 2026-05-21: disclosed: Initial disclosure to vendor
- 2026-06-12: advisory: GitHub Advisory published
- 2026-06-12: patched: Fix released in version 2.100.0

## References

- [https://api.github.com/users/kuranikaran](https://api.github.com/users/kuranikaran)
- [https://github.com/kuranikaran](https://github.com/kuranikaran)
- [https://api.github.com/users/kuranikaran/gists%7B/gist_id%7D](https://api.github.com/users/kuranikaran/gists%7B/gist_id%7D)
- [https://api.github.com/users/kuranikaran/repos](https://api.github.com/users/kuranikaran/repos)
- [https://avatars.githubusercontent.com/u/85026744?v=4](https://avatars.githubusercontent.com/u/85026744?v=4)
- [https://api.github.com/users/kuranikaran/events%7B/privacy%7D](https://api.github.com/users/kuranikaran/events%7B/privacy%7D)

## Related threats

- [Apple swift-nio WebSocket denial of service via oversize payload length](https://junglewise.ai/threats/cve-2026-43678-apple-swift-nio-websocket-denial-of-service-via-oversize-payload)
- [Apple SwiftNIO uncontrolled resource consumption in HTTPDecoder](https://junglewise.ai/threats/cve-2026-28980-apple-swiftnio-uncontrolled-resource-consumption-in-httpdecoder)
- [Apple SwiftNIO out-of-bounds write in ByteBuffer](https://junglewise.ai/threats/cve-2026-43671-apple-swiftnio-out-of-bounds-write-in-bytebuffer)