CVE-2026-64785 in swift-nio-http2
Summary
by MITRE • 07/23/2026
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability resides in the SwiftNIO HTTP/2 implementation where insufficient validation of inbound HEADERS frames allows control characters to propagate to an HTTP/1.1 backend through the NIOHTTP2 HTTP/2-to-HTTP/1 codec. The flaw specifically affects the protocol translation layer that handles bidirectional communication between HTTP/2 and HTTP/1.1 endpoints, creating a potential attack vector for malicious actors to manipulate request and response data flows. The vulnerability stems from the absence of proper input sanitization within the frame parsing logic that processes HTTP/2 HEADERS frames containing header name and value data. Control characters including carriage return CR, line feed LF, null NUL, and space SP characters can bypass validation mechanisms and directly reach downstream HTTP/1.1 services, which may interpret these characters in unexpected ways during processing.
The operational impact of this vulnerability extends beyond simple data corruption to enable sophisticated attack patterns such as HTTP request smuggling and response splitting. When control characters reach the HTTP/1.1 backend, they can manipulate how headers are parsed and processed, potentially allowing attackers to inject malicious content or manipulate the boundary between different HTTP messages. This type of vulnerability falls under CWE-1290, which addresses improper validation of control characters in protocol implementations, and aligns with ATT&CK technique T1071.004 for application layer protocol manipulation. The HTTP request smuggling aspect occurs when malformed headers can cause the backend server to misinterpret message boundaries, potentially allowing an attacker to inject or manipulate requests across different client sessions. Response splitting becomes possible when control characters in header values can create multiple responses that appear as a single response to clients.
The vulnerability represents a critical flaw in protocol translation security where the boundary between two distinct HTTP versions is not properly secured against malicious input. Attackers could exploit this by crafting specially crafted HTTP/2 HEADERS frames containing control characters that would be stripped or sanitized in normal HTTP/1.1 processing but are allowed through the SwiftNIO codec. This creates a pathway for attackers to bypass typical security controls and potentially gain unauthorized access to backend services, manipulate data flows, or perform injection attacks against vulnerable applications. The issue is particularly concerning in environments where HTTP/2 is used as an ingress protocol and HTTP/1.1 backends are still in use, which remains common in many enterprise deployments due to legacy system requirements. Organizations using SwiftNIO HTTP/2 implementations should immediately upgrade to version 1.45.0 or later to address this vulnerability, as the fix incorporates proper validation of control characters within inbound HEADERS frames and ensures appropriate sanitization before forwarding data to HTTP/1.1 backends.
Mitigation strategies should include immediate deployment of the patched SwiftNIO HTTP/2 library version 1.45.0, followed by comprehensive testing of all affected services to ensure proper handling of protocol translation scenarios. Network monitoring should be enhanced to detect unusual patterns in header processing that might indicate exploitation attempts, while security teams should review existing HTTP/2 implementations for similar validation gaps in other protocol components. The fix addresses the root cause by implementing strict validation rules that prevent control characters from reaching downstream services through the codec layer, ensuring that only properly formatted header data flows between HTTP/2 and HTTP/1.1 endpoints. Organizations should also consider implementing additional security controls such as header filtering rules and content inspection at network boundaries to provide defense-in-depth against similar vulnerabilities in other components of their infrastructure.