5.9 Medium

CVE-2026-86983 A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API…

Description

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: High
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
swift-crypto 5.0	earliest → < 5.0.3	5.0.3

References

github.com github.com

Timeline

Published October 28, 2026
Last modified November 4, 2026

The 2 CVEs of swift-crypto →

CVE-2026-43823 When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the… 7.5 High

Track this CVE