CVE-2026-63021

Summary Swift package upload parses every shallow "Package.swift" / "[email protected]" file in the uploaded archive into memory before any quota check. Each file is rejected only if it individually exceeds 128 KiB; there is no cap on the number of manifests or on their aggregate size. A...