Description
An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.
Published: 2026-08-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated remote peer can send a single 11‑byte frame after a completed WebSocket handshake to any server built on Swift‑nio that uses NIOWebSocket. The malformed frame causes the server process to crash, dropping all active connections until the service is restarted, resulting in a denial‑of‑service for applications that depend on WebSocket communication. The flaw involves improper input validation and an out‑of‑bounds condition (CWE‑20, CWE‑770).

Affected Systems

The vulnerability impacts any application that incorporates Swift‑nio and uses NIOWebSocket, including popular web frameworks such as Vapor and Hummingbird. All instances running a Swift‑nio version earlier than 2.101.0 are susceptible.

Risk and Exploitability

The attack can be launched from any network that can reach the vulnerable service, requiring no authentication or special privileges. The CVSS score of 5.3 indicates moderate severity, and although the EPSS score is unavailable, the simplicity of the exploit—sending a single 11‑byte frame—makes exploitation realistic for exposed servers. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 21, 2026 at 02:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Swift‑nio to version 2.101.0 or later to apply the bounding‑check fix.
  • If a patch is not immediately available, restrict inbound WebSocket traffic to trusted networks or employ network filtering to reject malformed frames before they reach the application.
  • Apply application‑level validation to enforce acceptable frame sizes and sanitize input data to mitigate similar input validation weaknesses.

Generated by OpenCVE AI on August 21, 2026 at 02:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*

Sun, 23 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Peer Can Crash NIOWebSocket‑Based Servers with 11‑Byte Frame swift-nio: swift-nio: Denial of Service via specially crafted WebSocket frame
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 21 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple swiftnio
Vendors & Products Apple
Apple swiftnio

Fri, 21 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Peer Can Crash NIOWebSocket‑Based Servers with 11‑Byte Frame

Thu, 20 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
References

Thu, 20 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
References

Thu, 20 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-770
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Description An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.
References

Subscriptions

Apple Swiftnio
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-08-20T21:10:49.702Z

Reserved: 2026-05-01T22:46:21.641Z

Link: CVE-2026-43678

cve-icon Vulnrichment

Updated: 2026-08-20T19:44:38.706Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-20T19:16:52.353

Modified: 2026-08-28T17:48:52.233

Link: CVE-2026-43678

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-20T18:57:03Z

Links: CVE-2026-43678 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T13:00:48Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-770

    Allocation of Resources Without Limits or Throttling