CVE-2026-28898

CVE-2026-28898 affects swift-nio-http2’s HTTP/2-to-HTTP/1.1 codec. The HTTP/2-to-HTTP/1.1 translation layer did not validate CR/LF/NUL bytes in pseudo-header values (:path, :authority, :scheme, :method, :status) before constructing HTTP/1.1 messages, enabling potential header injection or request...