Executive brief
Apple's SwiftNIO library, a framework for building high-performance network applications, contains a vulnerability in how it handles HTTP headers. An attacker can send a specially crafted request with an excessive number of headers to crash the server or exhaust its available memory. This can lead to a total service outage, preventing legitimate users from accessing the application.
Technical details
The `HTTPDecoder` component in `NIOHTTP1` lacks cumulative limits on the total size of HTTP/1 header blocks and the number of header fields per message. While individual fields were capped at 80 KB, an unauthenticated remote attacker can send hundreds of thousands of small, valid headers that are accumulated in memory before application logic executes. This results in uncontrolled resource consumption (CWE-400). Depending on the downstream framework, this leads to either linear memory inflation (e.g., Vapor 4) or a process crash due to precondition failures in header conversion (e.g., Hummingbird 2). The issue is fixed in version 2.100.0 by introducing configurable limits for header field size, list size, and field count.
Affected products
- Apple swift-nio <= 2.99.0
Timeline
- 2026-05-21: disclosed
- 2026-06-12: advisory
- 2026-06-12: patched