5.3
Medium
CVE-2026-43678 An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single…
Description
An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| swift-nio 2.101 | earliest → < 2.101.0 | 2.101.0 |
References
- github.com github.com
Timeline
- Published
- Last modified