CVE-2026-64785: Apple SwiftNIO HTTP/2 request smuggling via header validation bypass

Executive brief

Apple's SwiftNIO HTTP/2 library, used for building high-performance network applications, contains a flaw in how it handles web traffic headers. An attacker could send specially crafted requests to bypass security checks, potentially leading to 'request smuggling' where they can interfere with other users' sessions or bypass security filters. This could allow unauthorized access to data or the ability to manipulate how a web server responds to legitimate users.

Technical details

SwiftNIO HTTP/2 fails to properly validate inbound HEADERS frames for control characters like CR, LF, NUL, and SP when using the HTTP2ToHTTP1Codec. Regular header values were only checked against a forbidden-name list, allowing attackers to inject CRLF sequences to terminate fields early and inject extra headers into outbound HTTP/1.1 messages. Additionally, pseudo-headers like ':path' were not checked for spaces, allowing for request-target manipulation that causes parser differentials in downstream HTTP/1.1 backends. This vulnerability is primarily reachable in pipelines that skip outbound validation or trust pre-validated headers. The issue is fixed in version 1.45.0.

Affected products

• Apple swift-nio-http2 < 1.45.0

Timeline

• 2026-07-23: disclosed
• 2026-07-24: advisory
• 1.45.0: patched

References

• https://api.github.com/users/sour-exploit
• https://github.com/sour-exploit
• https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D
• https://api.github.com/users/sour-exploit/repos
• https://avatars.githubusercontent.com/u/288231323?v=4
• https://api.github.com/users/sour-exploit/events%7B/privacy%7D