CVE-2026-64785

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2...

OSV-2022-125 Invalid-free in NIOHTTP2.NIOHTTP2Handler.

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44431 Crash type: Invalid-free Crash state: NIOHTTP2.NIOHTTP2Handler. NIOHTTP2.NIOHTTP2Handler.channelRead NIOCore.ChannelHandlerContext...