CVE-2026-28898 SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec
Attackers can inject control characters into HTTP/2 pseudo-headers, potentially causing HTTP request smuggling or response splitting in applications using swift-nio-http2.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28898?
CVE-2026-28898 is a medium-severity vulnerability in Apple swift-nio-http2, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status) at both the HPACK header validation layer and the HTTP/2-to-HTTP/1.1 translation layer. Requests or responses containing CR, LF, or NUL bytes in any pseudo-header value are now rejected with a connection error. This issue is fixed in swift-nio-http2 1.44.1.
Weakness: CWE-116
Which versions are affected by CVE-2026-28898?
2 open source packages ship an affected version, including github.com/apple/swift-nio-http2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/apple/swift-nio-http2 SwiftURL | All versions | 1.44.0 |
github.com/apple/swift-nio-http2 SwiftURL | All versions | 1.44.0 |
Products include Apple Swiftnio Http\/2.
How do I fix CVE-2026-28898?
Upgrade github.com/apple/swift-nio-http2 to 1.44.0 or later.
Is CVE-2026-28898 being exploited?
There is no known exploitation of CVE-2026-28898 in the wild and no public exploit code.
Other vulnerabilities in Apple swift-nio-http2
- CVE-2022-0618 Denial of service via HTTP/2 HEADERS frames padding
- CVE-2022-24666 swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length
- CVE-2022-24667 swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding
- CVE-2022-24668 swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames
- CVE-2026-64785 swift-nio-http2: Missing CR/LF/NUL validation in header values
Sources
Also known as GHSA-4px2-pw77-vc85.