Skip to content

[GHSA-q3g2-m552-3r9c] swift-nio-http2: Missing CR/LF/NUL validation in header values #9642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
identity-wael wants to merge 1 commit into
base: identity-wael/advisory-improvement-9642
Choose a base branch
from
+2 −6
Open

[GHSA-q3g2-m552-3r9c] swift-nio-http2: Missing CR/LF/NUL validation in header values #9642

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions advisories/github-reviewed/2026/07/GHSA-q3g2-m552-3r9c/GHSA-q3g2-m552-3r9c.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,14 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q3g2-m552-3r9c",
"modified": "2026-07-24T21:52:10Z",
"modified": "2026-07-24T21:52:11Z",
"published": "2026-07-24T21:52:10Z",
"aliases": [
"CVE-2026-64785"
],
"summary": "swift-nio-http2: Missing CR/LF/NUL validation in header values",
"details": "## Summary\n\nSwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let\nCR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend\nthrough NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling\nor response splitting.\n\n## Impact\n\nTwo related gaps in inbound header validation, against any application\nusing HTTP2ToHTTP1Codec (or HTTP2FramePayloadToHTTP1Codec) to front an\nHTTP/1.1 backend:\n\nRegular header field values were only checked against a forbidden-name\nlist (connection, transfer-encoding, proxy-connection, keep-alive,\nupgrade); the value itself was never inspected. An attacker-controlled\nregular header field value containing CR or LF passed validation and, once\nserialized as `name: value CRLF` by the codec, terminated the field early\nand injected extra header lines into the outbound HTTP/1.1 message.\n\nPseudo-header values (`:path` in particular) were only checked against\nCR, LF and NUL. A `:path` value containing SP serializes into the\nrequest-target of `METHOD SP request-target SP HTTP-version CRLF`, so a\nvalue like `/a HTTP/1.1` produces `GET /a HTTP/1.1 HTTP/1.1` — a\nparser-differential request line depending on whether a downstream reader\ntakes the first or last SP-delimited token as the version.\n\nNeither of these is reachable on a stock pipeline: NIOHTTP1's outbound\nvalidator (`enableOutboundHeaderValidation`, on by default) already rejects\nthese characters on write. The exposure is pipelines that skip outbound\nvalidation, or any code that reads validated-looking `HTTPRequestHead.headers`\nand forwards the values on trusting that HTTP/2 already checked them.\n\n## Fix\n\nFixed in 48bfd90 and 45bdf67.\n\n## Mitigation\n\nUpgrade to 1.45.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
Expand All @@ -22,7 +18,7 @@
{
"package": {
"ecosystem": "SwiftURL",
"name": "swift-nio-http2"
"name": "github.com/apple/swift-nio-http2"
},
"ranges": [
{
Expand Down
Loading