CVE-2026-43678

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43678", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2026-05-01T22:46:21.641Z", "datePublished": "2026-08-20T18:57:03.222Z", "dateUpdated": "2026-08-20T21:10:49.702Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts."}]}], "affected": [{"vendor": "Apple", "product": "swift-nio", "versions": [{"version": "0", "status": "affected", "lessThan": "2.101.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0."}], "references": [{"url": "https://github.com/apple/swift-nio/security/advisories/GHSA-qcc5-f287-vgmq"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-08-20T21:10:49.702Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-770", "lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T19:44:43.228142Z", "id": "CVE-2026-43678", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:44:56.479Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-43678", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T19:44:43.228142Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:44:38.706Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "swift-nio", "versions": [{"status": "affected", "version": "0", "lessThan": "2.101.0", "versionType": "custom"}]}], "references": [{"url": "https://github.com/apple/swift-nio/security/advisories/GHSA-qcc5-f287-vgmq"}], "descriptions": [{"lang": "en", "value": "An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts."}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-08-20T21:10:49.702Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43678", "state": "PUBLISHED", "dateUpdated": "2026-08-20T21:10:49.702Z", "dateReserved": "2026-05-01T22:46:21.641Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2026-08-20T18:57:03.222Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "swift-nio", "vendor": "Apple", "versions": [{"lessThan": "2.101.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*", "matchCriteriaId": "A485750C-417C-4494-B603-7A0423E2B3D4", "versionEndExcluding": "2.101.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0."}, {"lang": "es", "value": "Un par remoto no autenticado puede colapsar cualquier servidor basado en NIOWebSocket (incluyendo Vapor y Hummingbird) con una \u00fanica trama de 11 bytes enviada despu\u00e9s de un establecimiento de conexi\u00f3n WebSocket completado, interrumpiendo todas las conexiones activas hasta que el proceso se reinicie. Esta vulnerabilidad se soluciona en swift-nio versi\u00f3n 2.101.0."}], "id": "CVE-2026-43678", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43678", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T19:44:43.228142Z", "version": "2.0.3"}}]}, "published": "2026-08-20T19:16:52.353", "references": [{"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://github.com/apple/swift-nio/security/advisories/GHSA-qcc5-f287-vgmq"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-770"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "swift-nio: swift-nio: Denial of Service via specially crafted WebSocket frame", "id": "2520715", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520715"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.", "A flaw was found in swift-nio. An unauthenticated remote attacker can crash any NIOWebSocket-based server by sending a single 11-byte frame after a completed WebSocket handshake. This vulnerability leads to a Denial of Service (DoS), dropping all active connections until the server process restarts."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to services utilizing `swift-nio` WebSocket functionality to trusted clients or networks. Implement firewall rules to limit inbound connections to the specific port(s) used by the vulnerable service. For example, using `firewalld` on Red Hat Enterprise Linux, administrators can add rules to allow traffic only from specific source IP addresses or ranges. This action limits the attack surface, but may impact legitimate users if not configured to allow necessary access. After applying firewall rules, reload the firewall configuration."}, "name": "CVE-2026-43678", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "swift-lang", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-20T18:57:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43678\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43678\nhttps://github.com/apple/container/security/advisories/GHSA-2v2q-4q35-h585"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.101.0)"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "swift-nio", "source": "cna", "vendor": "Apple"}, "product": "swiftnio", "vendor": "apple"}], "created": "2026-08-21T02:30:09.234206+00:00", "title": "Unauthenticated Remote Peer Can Crash NIOWebSocket\u2011Based Servers with 11\u2011Byte Frame", "updated": "2026-08-21T13:00:48.280555+00:00", "vendors": ["apple", "apple$PRODUCT$swiftnio"]}