CyberRota Analysis
AI-GeneratedThe vulnerability in SwiftNIO HTTP/2 allows unvalidated inbound HEADERS frames to pass control characters to an HTTP/1.1 backend, potentially leading to HTTP request smuggling or response splitting attacks. Organizations using affected versions of SwiftNIO HTTP/2 should prioritize updating to version 1.45.0 to mitigate the risk of exploitation. This issue is particularly relevant for developers and system administrators managing HTTP/2 traffic in their applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.