CVE-2026-64785 swift-nio-http2: Missing CR/LF/NUL validation in header values

What is CVE-2026-64785?

CVE-2026-64785 is a medium-severity vulnerability in Apple swift-nio-http2, published on 23 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.

Weakness: CWE-444

Which versions are affected by CVE-2026-64785?

2 open source packages ship an affected version, including swift-nio-http2. It affects 1 product.

Products include Apple Swiftnio Http\/2.

How do I fix CVE-2026-64785?

Upgrade swift-nio-http2 to 1.45.0 or later.

Is CVE-2026-64785 being exploited?

There is no known exploitation of CVE-2026-64785 in the wild and no public exploit code.

Other vulnerabilities in Apple swift-nio-http2

• CVE-2022-0618 Denial of service via HTTP/2 HEADERS frames padding High 7.5
• CVE-2022-24666 swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length High 7.5
• CVE-2022-24667 swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding High 7.5
• CVE-2022-24668 swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames High 7.5
• CVE-2026-28898 SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q3g2-m552-3r9c.