CVE-2026-28898: 
Swift vulnerability analysis and mitigation

CVE-2026-28898 is an HTTP/2-to-HTTP/1.1 request smuggling vulnerability in Apple's swift-nio-http2 library, caused by the failure to validate pseudo-header values for control characters before translating them into HTTP/1.1 messages. All versions of swift-nio-http2 prior to 1.44.1 are affected. The vulnerability was first published on May 21, 2026, and the GitHub Advisory Database entry was reviewed on June 12, 2026. The CVSS v3.1 base score is 5.3 (Medium) per Feedly threat intelligence data, though the GitHub Advisory rates it as Low (0.0) due to no direct confidentiality, integrity, or availability impact at the HTTP/2 layer itself (GitHub Advisory).

The root cause is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling) and CWE-116 (Improper Encoding or Escaping of Output). The HTTP2FramePayloadToHTTP1ServerCodec / HTTP2ToHTTP1ServerCodec components did not sanitize pseudo-header values (:path, :authority, :scheme, :method, :status) for CR (\r), LF (\n), or NUL (\0) bytes before inserting them into the translated HTTP/1.1 message. Because HTTP/2 uses binary framing, CRLF bytes are never interpreted as line terminators at the HTTP/2 layer, allowing them to pass through transparently and be interpreted as header delimiters in the downstream HTTP/1.1 output — enabling header injection or full request smuggling. This vulnerability is related to prior swift-nio issues GHSA-7fj7-39wj-c64f and GHSA-cq87-8r7h-962v, which addressed CRLF injection in HTTP/1.1 headers and request lines but did not cover HTTP/2 pseudo-headers (GitHub Advisory).

In deployments where swift-nio-http2 is used to translate HTTP/2 requests to HTTP/1.1 — such as reverse-proxy configurations — a remote unauthenticated attacker can inject arbitrary HTTP headers or smuggle entirely separate HTTP requests into the backend HTTP/1.1 stream. Server-side Swift frameworks such as Vapor that use this codec in a reverse-proxy pattern are directly affected. Successful exploitation could lead to cache poisoning, security control bypass, unauthorized access to backend resources, or session hijacking depending on the backend configuration (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report. The vulnerability is automatable (no user interaction or privileges required) and exploitable over the network, but the EPSS score is approximately 0.053% (0.000530), indicating a low near-term exploitation probability. The NVD SSVC assessment notes exploitation status as "none" (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify servers running swift-nio-http2 versions prior to 1.44.1 in a reverse-proxy configuration that translates HTTP/2 to HTTP/1.1 (e.g., Vapor-based applications).
2. Craft malicious HTTP/2 request: Construct an HTTP/2 request with a pseudo-header value (e.g., :path) containing embedded CR (\r), LF (\n), or NUL (\0) bytes — for example, :path: /legitimate-path\r\nInjected-Header: malicious-value.
3. Send the request: Transmit the crafted HTTP/2 request to the target server. Because HTTP/2 binary framing does not interpret CRLF as line terminators, the malicious bytes pass through the HTTP/2 layer without rejection.
4. Trigger translation: The server's HTTP2ToHTTP1ServerCodec translates the HTTP/2 request to HTTP/1.1 without stripping the control characters, inserting the injected bytes directly into the HTTP/1.1 message headers.
5. Achieve smuggling/injection: The downstream HTTP/1.1 backend interprets the injected CRLF bytes as header delimiters, resulting in injected headers or a smuggled secondary HTTP request, potentially bypassing security controls or poisoning shared caches (GitHub Advisory).

• Network: HTTP/2 requests to reverse-proxy endpoints containing unusual or encoded control characters (CR, LF, NUL) in pseudo-header values such as :path, :authority, :scheme, :method, or :status.
• Logs: Backend HTTP/1.1 server logs showing unexpected or malformed headers not originating from legitimate clients; duplicate or anomalous requests appearing in backend access logs that do not correspond to client-initiated requests.
• Application: Connection errors or resets from swift-nio-http2 1.44.1+ servers (post-patch) when receiving requests with control characters in pseudo-headers — these rejections may indicate active exploitation attempts against patched systems.

The fix is available in swift-nio-http2 version 1.44.1, which adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status) at both the HPACK header validation layer and the HTTP/2-to-HTTP/1.1 translation layer. Requests or responses containing CR, LF, or NUL bytes in any pseudo-header value are now rejected with a connection error. All adopters — particularly those using Vapor or other server-side Swift frameworks in reverse-proxy configurations — should upgrade to swift-nio-http2 1.44.1 as soon as possible. No configuration-based workaround is documented; upgrading is the only recommended remediation (GitHub Advisory).

The vulnerability was reported by researcher @kuranikaran and fixed by the SwiftNIO maintainer Lukasa. The Swift forums included a security release announcement covering swift-nio-http2 1.44.0/1.44.1 alongside other SwiftNIO component updates. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified.