The swift‑nio‑http2 library did not validate pseudo‑header values before translating HTTP/2 frames into HTTP/1.1 messages, allowing carriage return, line feed, or NUL characters to be injected into the resulting HTTP/1.1 header set. This omission could enable an attacker to craft HTTP/2 requests or responses containing control characters that corrupt the downstream HTTP/1.1 parsing logic, potentially leading to header injection or response splitting attacks.

Apple’s swift‑nio‑http2 library is affected. All versions prior to 1.44.1 expose the flaw; version 1.44.1 implements validation and rejects any pseudo‑header containing CR, LF, or NUL bytes with a connection error.

The CVSS score is 5.3, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a network connection that speaks HTTP/2; an adversary could send malicious pseudo‑headers containing control characters to a vulnerable server or client, resulting in malformed HTTP/1.1 headers that may be interpreted as injection points. No public exploit is known, but the lack of validation presents a real risk if an attacker can influence pseudo‑headers.