CVE-2026-64785

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64785", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2026-07-20T18:11:03.398Z", "datePublished": "2026-07-23T18:50:40.468Z", "dateUpdated": "2026-07-24T20:06:58.518Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting."}]}], "affected": [{"vendor": "Apple", "product": "swift-nio-http2", "versions": [{"version": "0", "status": "affected", "lessThan": "1.45.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0."}], "references": [{"url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-07-23T18:50:40.468Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-444", "lang": "en", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-24T20:06:09.684879Z", "id": "CVE-2026-64785", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T20:06:58.518Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-64785", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T20:06:09.684879Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T20:05:52.056Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "swift-nio-http2", "versions": [{"status": "affected", "version": "0", "lessThan": "1.45.0", "versionType": "custom"}]}], "references": [{"url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c"}], "descriptions": [{"lang": "en", "value": "SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting."}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-07-23T18:50:40.468Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64785", "state": "PUBLISHED", "dateUpdated": "2026-07-24T20:06:58.518Z", "dateReserved": "2026-07-20T18:11:03.398Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2026-07-23T18:50:40.468Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "swift-nio-http2", "vendor": "Apple", "versions": [{"lessThan": "1.45.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:swiftnio_http\\/2:*:*:*:*:*:swift:*:*", "matchCriteriaId": "FF813EAE-A8B8-46ED-8E48-6712A8FE8133", "versionEndExcluding": "1.45.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0."}, {"lang": "es", "value": "SwiftNIO HTTP/2 carec\u00eda de validaci\u00f3n en los marcos HEADERS entrantes, lo que permit\u00eda que CR, LF, NUL, SP y otros caracteres de control alcanzaran un backend HTTP/1.1 a trav\u00e9s del codec de HTTP/2 a HTTP/1 de NIOHTTP2, posibilitando el contrabando de solicitudes HTTP o la divisi\u00f3n de respuestas. Esta vulnerabilidad se ha solucionado en la versi\u00f3n 1.45.0 de swift-nio-http2."}], "id": "CVE-2026-64785", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64785", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-24T20:06:09.684879Z", "version": "2.0.3"}}]}, "published": "2026-07-23T20:17:21.440", "references": [{"source": "product-security@apple.com", "tags": ["Vendor Advisory", "Patch"], "url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "swift-nio-http2: SwiftNIO HTTP/2: HTTP Request Smuggling and Response Splitting via Incomplete Header Validation", "id": "2506592", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506592"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-93", "details": ["A flaw was found in SwiftNIO HTTP/2. This vulnerability allows a remote attacker to perform HTTP request smuggling or response splitting. The issue stems from insufficient validation of incoming HTTP/2 HEADERS frames, which are parts of an HTTP/2 request. This allows special control characters, such as carriage return (CR) and line feed (LF), to reach an HTTP/1.1 backend, potentially bypassing security controls and enabling malicious manipulation of web requests or responses."], "name": "CVE-2026-64785", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "critical", "package_name": "swift-lang", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-23T18:50:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64785\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64785\nhttps://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c"], "statement": "This vulnerability in SwiftNIO HTTP/2, which could lead to HTTP request smuggling or response splitting due to incomplete header validation, does not affect Red Hat products. Red Hat's analysis indicates that the affected component is not present or not configured in a vulnerable manner within supported offerings.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.45.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "matching"}]}, "original": {"product": "swift-nio-http2", "source": "cna", "vendor": "Apple"}, "product": "swiftnio_http/2", "vendor": "apple"}], "created": "2026-07-26T04:30:05.642091+00:00", "updated": "2026-08-02T15:30:17.456399+00:00", "vendors": ["apple", "apple$PRODUCT$swiftnio_http/2"]}