HTTP/2-to-HTTP/1.1 Codec Vulnerability in Swift NIO HTTP2 by Swift

CVE-2026-28898

What is CVE-2026-28898?

The swift-nio-http2 library's HTTP/2-to-HTTP/1.1 codec originally failed to validate pseudo-header values, making it susceptible to control character manipulations before processing. This oversight allows potentially harmful characters (such as CR, LF, or NUL bytes) to be included in translated HTTP/1.1 messages, which could lead to unexpected behavior or security risks. In version 1.44.1, the library has implemented rigorous validation checks for pseudo-header values, ensuring requests or responses that contain such control characters are promptly rejected, thus enhancing the overall security posture of applications utilizing this library.

References