Executive brief
Apple's Swift-NIO-SSL library, used for securing network communications in Swift applications, contains a memory safety flaw. An attacker could provide a specially crafted security certificate that causes the application to read memory outside of its intended boundaries. This could lead to the exposure of sensitive information or cause the application to crash, potentially impacting service availability and data privacy.
Technical details
An out-of-bounds (OOB) memory access vulnerability exists in the `NIOSSLCertificate._subjectAlternativeNames` API of the swift-nio-ssl library. The root cause is an incorrect assumption that all Subject Alternative Name (SAN) entries are backed by an `ASN1_STRING` structure in the underlying BoringSSL union. When processing non-string-shaped SAN types (such as `otherName`, `x400Address`, or `directoryName`), the library attempts to read a buffer pointer and length from memory locations that do not contain those values. An attacker providing a malicious X.509 certificate can trigger this OOB read when the application iterates through SANs using the affected API. While internal library usage is safe due to type-checking, external callers of this underscored API are vulnerable. The issue is resolved in version 2.37.2.
Affected products
- Apple swift-nio-ssl >= 2.18.0, <= 2.37.1
Timeline
- 2026-07-15: advisory: GitHub advisory published by maintainers
- 2026-07-23: disclosed: NVD publication date
- 2026-07-23: patched: Fix addressed in version 2.37.2