CVE-2026-28975: Apple swift-nio-extras decompression ratio limit bypass in NIOHTTPRequestDecompressor

CVE-2026-28975 · Severity: medium · CVSS 6.9 · Published 2026-06-12

A vulnerability in the Swift NIO Extras library allows attackers to bypass security limits designed to prevent 'zip bomb' attacks. By providing a fake size value in a web request, an attacker can force the server to decompress massive amounts of data, potentially crashing the service or exhausting its memory. This can lead to a denial-of-service (DoS) condition where the application becomes unavailable to legitimate users.

Vendors: Apple, Swift.

Quick answers

Is CVE-2026-28975 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28975 being exploited in the wild.
How severe is CVE-2026-28975?
Medium severity, with a CVSS score of 6.9, published 12 June 2026.
Which products and versions are affected?
github.com/apple/swift-nio-extras (Swift) < 1.34.1.
Is there a fix for CVE-2026-28975?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-28975 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-28975?
Check whether you run Apple SwiftNIO Extras or github.com/apple/swift-nio-extras (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The NIOHTTPRequestDecompressor component in swift-nio-extras fails to properly validate decompression ratios when configured with the .ratio(N) limit. The implementation relies on the attacker-controlled Content-Length header as the denominator for ratio calculations instead of the actual number of compressed bytes received. An attacker can exploit this by sending a highly compressed payload (gzip bomb) with an artificially inflated Content-Length header, causing the ratio check to always pass. This results in unbounded memory consumption during decompression. The vulnerability is fixed in version 1.34.1 by tracking actual received bytes.

Affected products

  • Apple swift-nio-extras < 1.34.1

Identifiers

  • CVE-2026-28975
  • GHSA-6ph5-fww6-vfwv

Timeline

  • 2026-05-21: disclosed
  • 2026-06-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.