Swift W3C TraceContext fails to properly validate the value of a W3C Trace Context HTTP header, allowing a malformed header sent over the network to trigger a crash of the process that uses the library. The impact is a denial‑of‑service condition and potential unavailability of the affected service, but it does not provide remote code execution or privilege escalation. The weakness is an instance of Improper Input Validation (CWE‑20).

All Swift W3C TraceContext implementations prior to version 1.0.0‑beta.5 and all Swift OTel implementations prior to version 1.0.4 are vulnerable. These components are commonly embedded in Swift Log, Swift Metrics, and Swift Distributed Tracing setups and are typically exposed through an HTTP server that consumes incoming Trace Context headers. If these libraries are in the request‑processing pipeline, the service is at risk.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known, current exploits. Attackers would need only the ability to send a crafted HTTP request to a server that uses the vulnerable library; the malformed header would trigger a crash, causing a denial of service. No additional privileges or administrative access are required.