111 matches found
CVE-2026-43678
An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...
CVE-2026-43678
An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...
CVE-2026-43678
A flaw in swift-nio allows an unauthenticated remote attacker to crash any NIOWebSocket-based server , including those using Vapor and Hummingbird . By sending a single 11-byte frame following a completed WebSocket handshake, the attacker can trigger a Denial of Service (DoS) , dropping all activ...
CVE-2026-43678
An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...
CVE-2026-43678: Improper Input Validation
An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...
GHSA-RJ37-6J9X-74Q6 SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS
Summary The HTTPDecoder in NIOHTTP1 enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fields per message. A remote peer can submit an arbitrary number of small, valid headers in a single request and have them all accumulated into the resulting...
SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec
swift-nio-http2's HTTP/2-to-HTTP/1.1 codec HTTP2FramePayloadToHTTP1ServerCodec / HTTP2ToHTTP1ServerCodec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. A remote attacker could send an HTTP/2 request containing CR \r, LF \n, o...
Improper Encoding or Escaping of Output
Overview vapor/leaf-kit is an an expressive, performant, and extensible templating language built for Swift. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the htmlEscaped process. An attacker can inject and execute arbitrary scripts in the context ...
leafkit 安全漏洞
Leafkit is an open-source application developed by Vapor. It uses Swift to create modular server-side software. Versions of Leafkit prior to 1.4.1 contained security vulnerabilities. These vulnerabilities stemmed from the fact that htmlEscaped only matched extended character clusters, which could...
EUVD-2023-1801
Malicious code in bioql PyPI...
EUVD-2023-1872
Malicious code in bioql PyPI...
EUVD-2023-1891
Malicious code in bioql PyPI...
EUVD-2023-2631
Malicious code in bioql PyPI...
EUVD-2024-0412
Malicious code in bioql PyPI...
EUVD-2023-1889
Malicious code in bioql PyPI...
EUVD-2023-1859
Malicious code in bioql PyPI...
Malicious code in @malware-test-vapor-masty-zeros-matte/test-mlw3-vapor-masty-zeros-matte (npm)
The package @malware-test-vapor-masty-zeros-matte/test-mlw3-vapor-masty-zeros-matte was found to contain malicious code...
MAL-2025-9047 Malicious code in @malware-test-vapor-masty-zeros-matte/test-mlw3-vapor-masty-zeros-matte (npm)
The package @malware-test-vapor-masty-zeros-matte/test-mlw3-vapor-masty-zeros-matte was found to contain malicious code...