CVE-2026-43678

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/apple/swift-nio/security/advisories/GHSA-qcc5-f287-vgmq	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Un par remoto no autenticado puede colapsar cualquier servidor basado en NIOWebSocket (incluyendo Vapor y Hummingbird) con una única trama de 11 bytes enviada después de un establecimiento de conexión WebSocket completado, interrumpiendo todas las conexiones activas hasta que el proceso se reinicie. Esta vulnerabilidad se soluciona en swift-nio versión 2.101.0.

Information

Published : 2026-08-20 19:16

Updated : 2026-10-18 20:10

NVD link : CVE-2026-43678

Mitre link : CVE-2026-43678

CVE.ORG link : CVE-2026-43678

JSON object : View

Products Affected

apple

swiftnio

CWE

CWE-20

Improper Input Validation

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-43678", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43678", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T19:44:43.228142Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Apple", "product": "swift-nio", "versions": [{"status": "affected", "version": "0", "lessThan": "2.101.0", "versionType": "custom"}]}]}], "published": "2026-08-20T19:16:52.353", "references": [{"url": "https://github.com/apple/swift-nio/security/advisories/GHSA-qcc5-f287-vgmq", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0."}, {"lang": "es", "value": "Un par remoto no autenticado puede colapsar cualquier servidor basado en NIOWebSocket (incluyendo Vapor y Hummingbird) con una \u00fanica trama de 11 bytes enviada despu\u00e9s de un establecimiento de conexi\u00f3n WebSocket completado, interrumpiendo todas las conexiones activas hasta que el proceso se reinicie. Esta vulnerabilidad se soluciona en swift-nio versi\u00f3n 2.101.0."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A485750C-417C-4494-B603-7A0423E2B3D4", "versionEndExcluding": "2.101.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}