CVE-2026-28898

Name of the Vulnerable Software and Affected Versions swift-nio-http2 versions prior to 1.44.0

Description The HTTP/2-to-HTTP/1.1 codec, specifically HTTP2FramePayloadToHTTP1ServerCodec and HTTP2ToHTTP1ServerCodec, fails to validate pseudo-header values for control characters before translating them into HTTP/1.1 messages. A remote attacker can send HTTP/2 requests containing Carriage Return (CR), Line Feed (LF), or Null (NUL) bytes in pseudo-headers such as :path. Because HTTP/2 uses binary framing, these characters are not parsed as line terminators at the HTTP/2 layer and are passed to the HTTP/1.1 output. This can lead to request smuggling, where the resulting output contains injected headers or entirely smuggled requests, particularly in reverse-proxy configurations. This issue affects any server translating HTTP/2 requests to HTTP/1.1, including server-side Swift frameworks like Vapor.

Recommendations Update to version 1.44.0 or later.