Swift Project vulnerabilities
We track 10 vulnerabilities in Swift Project products across 7 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on January 15, 2025.
Latest Swift Project vulnerabilities
- 7.5 High severity
Swift ASN1: Improper Handling of Syntactically Invalid Structure
Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself which assumes that certain objects can only be provided in either constructed or primitive forms, and will trigger a
- 8.8 High severity
Swift Foundation: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers. In this vulnerability, a client can insert one or several CRLF sequences into a URLRequest header value. When that request
- 7.5 High severity
Async HTTP Client: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users ar
- 7.5 High severity
SwiftNIO: Improper Neutralization of Special Elements in Output Used by a Downstream Component
NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some fo
- 7.5 High severity
SwiftNIO Extras: Loop with Unreachable Exit Condition
Improper detection of complete HTTP body decompression SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies. These two objects (HTTPRequestDecompressor and HTTPResponseDecompressor) both failed to
- 7.5 High severity
Swift Corelib-Foundation: Incorrect Type Conversion or Cast
A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mecha
- 7.5 High severity
SwiftNIO HTTP2: Improper Handling of Length Parameter Inconsistency
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSH_PROMISE frame where the
- 7.5 High severity
SwiftNIO HTTP2: Improper Handling of Unexpected Data Type
A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after f
- 7.5 High severity
SwiftNIO HTTP2: Integer Overflow or Wraparound
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded header block. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. There are a number of implement
- 7.5 High severity
SwiftNIO HTTP2: Improper Handling of Length Parameter Inconsistency
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical err