# CVE-2026-43678: Apple swift-nio WebSocket denial of service via oversize payload length

Source: https://junglewise.ai/threats/cve-2026-43678-apple-swift-nio-websocket-denial-of-service-via-oversize-payload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-43678 · Severity: medium · CVSS 5.3 · Published 2026-08-20

Swift-NIO is an open-source networking library used to build WebSocket servers in frameworks like Vapor and Hummingbird. An unauthenticated attacker can send a specially crafted 11-byte WebSocket frame that crashes the entire server process, disconnecting all active users until the service is manually restarted. This denies service to legitimate users without requiring any authentication or complex attack techniques.

Technologies: [Apple SwiftNIO](https://junglewise.ai/threats/technologies/swiftnio). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple).

## Quick answers

**Is CVE-2026-43678 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43678 being exploited in the wild.

**How severe is CVE-2026-43678?** Medium severity, with a CVSS score of 5.3, published 20 August 2026.

**Which products and versions are affected?** Apple Swift-Nio <=2.100.0.

**Is there a fix for CVE-2026-43678?** A patch was published on 2026-07-09: Fixed in swift-nio 2.101.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43678 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-43678?** Check whether you run Apple Swift-Nio, Apple SwiftNIO, Hummingbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in WebSocketFrameDecoder's handling of the 8-byte extended payload length field defined in RFC 6455 §5.2. The decoder used Swift's trapping Int(_:) initializer to convert this field, which triggers a fatal runtime trap when the value has the most-significant bit set (≥0x8000_0000_0000_0000). This integer overflow trap fires before maxFrameSize validation and cannot be caught by the ByteToMessageDecoder, leaving all NIOWebSocket-based servers vulnerable. An attacker can trigger this with a single network-reachable request containing a malicious 11-byte frame after completing a WebSocket handshake, no authentication required. The fix (swift-nio 2.101.0) replaces the trapping initializer with Int(exactly:) and properly throws NIOWebSocketError.invalidFrameLength for out-of-range values.

## Affected products

- Apple swift-nio <=2.100.0
- Vapor Vapor
- Hummingbird Hummingbird

## Timeline

- 2026-07-09: disclosed
- 2026-07-09: patched: Fixed in swift-nio 2.101.0
- 2026-08-20: advisory

## References

- [https://github.com/apple/swift-nio/security/advisories/GHSA-qcc5-f287-vgmq](https://github.com/apple/swift-nio/security/advisories/GHSA-qcc5-f287-vgmq)

## Related threats

- [Apple SwiftNIO uncontrolled resource consumption in HTTPDecoder](https://junglewise.ai/threats/cve-2026-28980-apple-swiftnio-uncontrolled-resource-consumption-in-httpdecoder)
- [Apple SwiftNIO out-of-bounds write in ByteBuffer](https://junglewise.ai/threats/cve-2026-43671-apple-swiftnio-out-of-bounds-write-in-bytebuffer)
- [Apple SwiftNIO CRLF injection in HTTP validator handlers](https://junglewise.ai/threats/cve-2026-28970-apple-swiftnio-crlf-injection-in-http-validator-handlers)