CVE-2026-64785 is a medium-severity (CVSS 5.3) CWE-444 vulnerability in swift-nio-http2. A fix is available for swift-nio-http2 — see the affected versions and patch details below.
swift-nio-http2: Missing CR/LF/NUL validation in header values
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-64785.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-64785 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
swift-nio-http2Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects SwiftURL packages — download data is not available via public APIs for these ecosystems.
Description
Summary
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting.
Impact
Two related gaps in inbound header validation, against any application using HTTP2ToHTTP1Codec (or HTTP2FramePayloadToHTTP1Codec) to front an HTTP/1.1 backend:
Regular header field values were only checked against a forbidden-name
list (connection, transfer-encoding, proxy-connection, keep-alive,
upgrade); the value itself was never inspected. An attacker-controlled
regular header field value containing CR or LF passed validation and, once
serialized as name: value CRLF by the codec, terminated the field early
and injected extra header lines into the outbound HTTP/1.1 message.
Pseudo-header values (:path in particular) were only checked against
CR, LF and NUL. A :path value containing SP serializes into the
request-target of METHOD SP request-target SP HTTP-version CRLF, so a
value like /a HTTP/1.1 produces GET /a HTTP/1.1 HTTP/1.1 — a
parser-differential request line depending on whether a downstream reader
takes the first or last SP-delimited token as the version.
Neither of these is reachable on a stock pipeline: NIOHTTP1's outbound
validator (enableOutboundHeaderValidation, on by default) already rejects
these characters on write. The exposure is pipelines that skip outbound
validation, or any code that reads validated-looking HTTPRequestHead.headers
and forwards the values on trusting that HTTP/2 already checked them.
Fix
Fixed in 48bfd90 and 45bdf67.
Mitigation
Upgrade to 1.45.0
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦SwiftURL | swift-nio-http2 | all versions | 1.45.0 |
Affected Products
swiftnio http\/2appleDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for swift-nio-http2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update swift-nio-http2 to 1.45.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-64785 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2026-64785 in your dependencies?
Find it across SwiftURL, including transitive dependencies.