Executive brief
swift-nio-ssh is a cryptographic SSH implementation library used by applications built on Apple's Swift platform to secure remote connections. An unauthenticated attacker can send a single malicious SSH message to trigger an out-of-bounds stack write with attacker-controlled data, causing application crashes, memory corruption, or potential code execution without needing valid credentials.
Technical details
The vulnerability is an out-of-bounds stack write (CWE-787) caused by improper length validation (CWE-130) in ECDSA signature parsing. When swift-nio-ssh receives an SSH message containing an ECDSA signature, it copies the signature integer fields to a stack buffer without first validating their length against the buffer size. This occurs during message parsing, before cryptographic verification of the signature or public key. An unauthenticated network attacker can exploit this by sending a crafted SSH_MSG_USERAUTH_REQUEST (server-side) or triggering the vulnerability via ECDSA signature in key-exchange replies (client-side). The attack requires only that the SSH version and KEXINIT handshake be completed—no credentials or authentication are necessary. The vulnerability is fixed in version 0.14.1.
Affected products
- Apple swift-nio-ssh <= 0.14.0
Timeline
- 2026-07-17: disclosed: Advisory published by Apple Security on GitHub
- 2026-07-17: patched: Fixed in version 0.14.1