CVE-2026-64785: 
Swift vulnerability analysis and mitigation

CVE-2026-64785 is a missing header validation vulnerability in Apple's SwiftNIO HTTP/2 library (swift-nio-http2) that enables HTTP request smuggling and HTTP response splitting attacks. The flaw exists in all versions of swift-nio-http2 prior to 1.45.0 and was published on July 23, 2026. It carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 6.3 (Medium) (GitHub Advisory, Swift NIO Advisory).

The vulnerability stems from two related gaps in inbound HEADERS frame validation within NIOHTTP2's HTTP/2-to-HTTP/1.1 codec (CWE-444, CWE-113). First, regular header field values were only checked against a forbidden-name list (e.g., connection, transfer-encoding) but the value content itself was never inspected — allowing attacker-controlled values containing CR or LF to pass through and, once serialized as name: value CRLF, inject extra header lines into the outbound HTTP/1.1 message. Second, pseudo-header values such as :path were only checked against CR, LF, and NUL, but not SP; a :path value like /a HTTP/1.1 would serialize into an ambiguous request line (GET /a HTTP/1.1 HTTP/1.1) exploitable via parser-differential behavior in downstream readers. The exposure is limited to pipelines using HTTP2ToHTTP1Codec or HTTP2FramePayloadToHTTP1Codec that skip NIOHTTP1's outbound header validation (enableOutboundHeaderValidation), which is enabled by default on stock pipelines (Swift NIO Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to inject malicious control characters into HTTP headers forwarded to HTTP/1.1 backends, enabling HTTP request smuggling (CAPEC-33) or HTTP response splitting (CAPEC-34). This can lead to cache poisoning, session hijacking, bypassing of security controls, or unauthorized access to backend resources by manipulating how downstream servers interpret HTTP messages. Availability is not directly impacted, but integrity of HTTP communications between the proxy and backend is compromised (GitHub Advisory, Swift NIO Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.135–0.181%, placing it in the 8th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies it as automatable with partial technical impact (GitHub Advisory).

1. Identify target: Locate applications using swift-nio-http2 versions prior to 1.45.0 that proxy HTTP/2 traffic to an HTTP/1.1 backend via HTTP2ToHTTP1Codec or HTTP2FramePayloadToHTTP1Codec, particularly those that have disabled or bypassed NIOHTTP1's outbound header validation.
2. Craft malicious HEADERS frame: Construct an HTTP/2 request with a regular header field whose value contains embedded CR (\r) or LF (\n) characters — e.g., X-Custom-Header: legitimate\r\nX-Injected: malicious.
3. Send the request: Transmit the crafted HTTP/2 request to the vulnerable server endpoint. The codec passes the value without inspecting its content.
4. Trigger header injection: The codec serializes the header as X-Custom-Header: legitimate\r\nX-Injected: malicious\r\n, injecting an extra header line into the outbound HTTP/1.1 message sent to the backend.
5. Alternatively, exploit :path smuggling: Send a :path pseudo-header value containing a space, such as /a HTTP/1.1, causing the serialized request line to become GET /a HTTP/1.1 HTTP/1.1 — exploiting parser-differential behavior in the downstream HTTP/1.1 server to smuggle a secondary request.
6. Achieve objective: Use the injected headers or smuggled request to poison caches, hijack sessions, bypass access controls, or manipulate backend responses (Swift NIO Advisory, GitHub Advisory).

• Network: HTTP/2 requests containing raw CR (\r), LF (\n), NUL (\0), or unexpected SP characters in header field values or :path pseudo-headers; anomalous or duplicate HTTP/1.1 headers observed in backend server logs that do not correspond to client-sent headers.
• Logs: Backend HTTP/1.1 server access logs showing unexpected headers (e.g., injected X-Forwarded-For, Host, or authorization headers) not present in the original client request; malformed or ambiguous request lines in backend logs (e.g., GET /a HTTP/1.1 HTTP/1.1).
• Application Behavior: Unexpected cache entries or responses served to users that do not match their requests; session tokens or cookies appearing in responses for unrelated users, indicating cache poisoning or session hijacking.

Upgrade swift-nio-http2 to version 1.45.0 or later, which includes fixes in commits 48bfd90 and 45bdf67 that add proper validation of control characters in both regular header field values and pseudo-header values. As a workaround for pipelines that cannot immediately upgrade, ensure NIOHTTP1's outbound header validation (enableOutboundHeaderValidation) is enabled (it is on by default in stock pipelines), which will reject these characters at the write stage. Review any custom pipeline configurations that bypass outbound validation or forward HTTPRequestHead.headers values to other systems without re-validation (Swift NIO Advisory, GitHub Advisory).