VYPR
← All advisories
Medium severity5.3GHSA Advisory· Published Jun 25, 2026· Updated Jun 30, 2026

CVE-2026-28898

CVE-2026-28898

Description

swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status) at both the HPACK header validation layer and the HTTP/2-to-HTTP/1.1 translation layer. Requests or responses containing CR, LF, or NUL bytes in any pseudo-header value are now rejected with a connection error. This issue is fixed in swift-nio-http2 1.44.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/apple/swift-nio-http2SwiftURL
< 1.44.01.44.0

Affected products

2

Patches

Vulnerability mechanics

References

4

News mentions

1