What is the CVSS score of CVE-2026-23886?

CVE-2026-23886 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Swift W3C TraceContext are affected by CVE-2026-23886?

Organizations using Swift W3C TraceContext should be aware of moderate risk from CVE-2026-23886, a input validation vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-23886?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Swift W3C TraceContext CVE-2026-23886

MEDIUM

Improper Input Validation (CWE-20)

2026-01-19 security-advisories@github.com

Denial Of Service

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 19, 2026 - 21:15 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol (OTLP) backend for Swift Log, Swift Metrics, and Swift Distributed Tracing. Prior to Swift W3C TraceContext version 1.0.0-beta.5 and Swift OTel version 1.0.4, a denial-of-service vulnerability due to improper input validation allows a remote attacker to crash the service via a malformed HTTP header. This allows crashing the process with data coming from the network when used with, for example, an HTTP server. Most common way of using Swift W3C Trace Context is through Swift OTel. Version 1.0.0-beta.5 of Swift W3C TraceContext and version 1.0.4 of Swift OTel contain a patch for this issue. As a workaround, disable either Swift OTel or the code that extracts the trace information from an incoming header (such as a TracingMiddleware).

AnalysisAI

Swift W3C TraceContext and Swift OTel improperly validate malformed HTTP headers, enabling remote attackers to crash affected services through denial-of-service attacks. This vulnerability affects applications using these libraries for distributed tracing and telemetry, particularly HTTP servers processing untrusted network input. No patch is currently available, though versions 1.0.0-beta.5 of Swift W3C TraceContext and 1.0.4 of Swift OTel are expected to address the issue.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol (OTLP) backend for Swift Log, Swift Metrics, and Swift Distributed Tracing. Prior to Swift W3C TraceContext version 1.0.0-beta.5 and Swift OTel version 1.0.4, a denial-of-service vulnerability due to improper input validation allows a remote attacker to crash the service via a malformed HTTP header. This allows crashing the process with data coming from the network when

Affected ProductsAI

Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol (OTLP) backend for Swi