CVE-2026-64785

MediumCVSS 5.3/10Last modified Oct 24, 2026

Description

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-444

Affected software

Vendor	Product	Versions
Apple	swift-nio-http2	< 1.45.0

References

https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9cVendor Advisory, Patch

Timeline

Published: Jul 23, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-647876.5A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, CVE-2026-647885.4The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27,CVE-2026-647895.5This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, mac CVE-2026-64797.5Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve su CVE-2026-647907.8A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 2 CVE-2026-647918.8Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator rou CVE-2026-647927.5Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search ind CVE-2026-647939.1Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content ta CVE-2026-647946.5Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters a CVE-2026-647955.4Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, modul CVE-2026-647969.8Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator a CVE-2026-647977.5Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without