CVE-2026-64785

Name of the Vulnerable Software and Affected Versions swift-nio-http2 versions prior to 1.45.0

Description SwiftNIO HTTP/2 lacks validation for inbound HEADERS frames, allowing control characters such as CR, LF, NUL, and SP to reach an HTTP/1.1 backend via the HTTP/2-to-HTTP/1 codec. This can lead to HTTP request smuggling or response splitting. The issue occurs because regular header field values are not inspected for CR or LF characters, and pseudo-header values, specifically :path, are not checked for SP characters. This creates a parser differential in the request line. The risk is present in pipelines that skip outbound validation or code that forwards HTTPRequestHead.headers values assuming they were previously validated.

Recommendations Update to version 1.45.0.