The vulnerability is in the P‑384 VOPRF API of swift‑crypto, where no maximum input length is enforced. An attacker who can supply arbitrary data to this API can cause the process to terminate, leading to a denial of service for any application that uses the library. This is a classic example of an unbounded input flaw that results in a crash, corresponding to CWE‑400.

Apple swift‑crypto before version 5.0.3 is affected. Any project or service that incorporates this library and exposes the VOPRF API to external data must be considered vulnerable until the patch is applied. The issue is limited to the specific cryptographic routine and does not appear to affect other Swift Crypto functions.

No CVSS score is disclosed and the EPSS score is unavailable, which limits precise severity assessment. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nonetheless, any process that accepts external input and forwards it to the VOPRF API can be targeted. An attacker would craft specially sized data to trigger a crash, thereby disrupting availability. The likely attack vector involves remote input directed at the API, so the risk is a remote denial of service on affected services.