CVE-2026-28980: Apple SwiftNIO uncontrolled resource consumption in HTTPDecoder

CVE-2026-28980 · Severity: high · CVSS 8.7 · Published 2026-06-12

Apple's SwiftNIO library, a framework for building high-performance network applications, contains a vulnerability in how it handles HTTP headers. An attacker can send a specially crafted request with an excessive number of headers to crash the server or exhaust its available memory. This can lead to a total service outage, preventing legitimate users from accessing the application.

Technologies: Apple SwiftNIO, github.com/apple/swift-nio (Swift). Vendors: Apple, Swift.

Quick answers

Is CVE-2026-28980 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28980 being exploited in the wild.
How severe is CVE-2026-28980?
High severity, with a CVSS score of 8.7, published 12 June 2026.
Which products and versions are affected?
Apple SwiftNIO <= 2.99.0; github.com/apple/swift-nio (Swift) <= 2.99.0.
Is there a fix for CVE-2026-28980?
A patch was published on 2026-06-12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28980 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-28980?
Check whether you run Apple SwiftNIO or github.com/apple/swift-nio (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The `HTTPDecoder` component in `NIOHTTP1` lacks cumulative limits on the total size of HTTP/1 header blocks and the number of header fields per message. While individual fields were capped at 80 KB, an unauthenticated remote attacker can send hundreds of thousands of small, valid headers that are accumulated in memory before application logic executes. This results in uncontrolled resource consumption (CWE-400). Depending on the downstream framework, this leads to either linear memory inflation (e.g., Vapor 4) or a process crash due to precondition failures in header conversion (e.g., Hummingbird 2). The issue is fixed in version 2.100.0 by introducing configurable limits for header field size, list size, and field count.

Affected products

  • Apple swift-nio <= 2.99.0

Identifiers

  • CVE-2026-28980
  • GHSA-rj37-6j9x-74q6

Timeline

  • 2026-05-21: disclosed
  • 2026-06-12: advisory
  • 2026-06-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.