Which versions of SwiftNIO are affected by CVE-2026-28980?

Apple's SwiftNIO NIOHTTP1 HTTP server library (versions 2.99.0 and earlier) contains a denial-of-service vulnerability that allows remote attackers to exhaust server memory or crash application…

How to fix or mitigate CVE-2026-28980?

Within 24 hours: Inventory all systems running SwiftNIO ≤2.99.0, Hummingbird 2, or Vapor 4 frameworks and document exposed services and endpoints. Within 7 days: Implement protective controls including header count/size limits at reverse proxy layer (recommended maximum 100 header fields), HTTP request rate limiting, and request validation rules; test configurations in staging environments. Within 30 days: Monitor Apple and vendor security advisories for patch releases; begin planning and testing upgrades to patched SwiftNIO versions when available.

SwiftNIO CVE-2026-28980

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-12 https://github.com/apple/swift-nio

GHSA-rj37-6j9x-74q6

Microsoft Denial Of Service

Severity by source

vuln.today AI

7.5 HIGH

Vendor states a single unauthenticated remote peer can trigger DoS over HTTP/1 (AV:N/AC:L/PR:N/UI:N); impact is availability-only (process crash or memory exhaustion), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Source Code Evidence Fetched

Jun 12, 2026 - 15:52 vuln.today

Analysis Generated

Jun 12, 2026 - 15:52 vuln.today

DescriptionCVE.org

Summary

The HTTPDecoder in NIOHTTP1 enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fields per message. A remote peer can submit an arbitrary number of small, valid headers in a single request and have them all accumulated into the resulting HTTPHeaders value before any application code runs. This can be used to exhaust memory, or - for consumers that subsequently convert headers into swift-http-types' HTTPFields - to crash the process.

Details

HTTPDecoder previously enforced only a single hardcoded parsing limit: 80 KB per individual header field (name + value). There was no cap on the cumulative size of the header block, nor on the number of header fields per message. Because each individual field can remain well below the 80 KB threshold, a peer can submit hundreds of thousands of valid headers in a single request, all of which are appended to the decoded HTTPHeaders without bound.

The headers are then visible to user code through the standard HTTPServerRequestPart.head / HTTPClientResponsePart.head events. Two observed downstream effects:

Hummingbird 2 (and other consumers that bridge HTTPHeaders into swift-http-types' HTTPFields) crashes via a precondition failure inside HTTPFields once the configured field count is exceeded.
Vapor 4 does not crash, but the per-request memory footprint scales linearly with the number of headers received, allowing a single connection to inflate server memory use substantially.

Impact

A single unauthenticated remote peer can trigger a denial of service against any HTTP/1 server (or, in the response direction, any HTTP/1 client) built on NIOHTTP1 - either by crashing the process, depending on the downstream framework, or by driving the process's resident memory to arbitrary sizes.

Patches

This issue is addressed in swift-nio 2.100.0 and later.

The HTTPDecoder now applies three parsing limits with conservative defaults, exposed through the new NIOHTTPDecoderLimitConfiguration type:

Limit	Default
`maxHeaderFieldSize`	80 KB
`maxHeaderListSize`	2 MB
`maxHeaderFieldCount`	256

Exceeding any of these limits causes the decoder to fail with HTTPParserError.headerOverflow. The configuration can be supplied directly to HTTPRequestDecoder / HTTPResponseDecoder, or via the decoderConfiguration property on NIOUpgradableHTTPServerPipelineConfiguration and NIOUpgradableHTTPClientPipelineConfiguration.

Users who require larger limits - for example, applications that legitimately exchange very large header blocks - can opt into them explicitly by constructing a custom NIOHTTPDecoderLimitConfiguration.

Workarounds

Users unable to upgrade can mitigate by placing a reverse proxy in front of the service that enforces equivalent limits on request header count and total header size.

Credit

This issue was reported by @Joannis. SwiftNIO thanks @Joannis for the report and the support in landing the fix.

AnalysisAI

Denial of service in Apple's SwiftNIO NIOHTTP1 module (versions <= 2.99.0) allows unauthenticated remote attackers to exhaust server memory or crash processes by submitting HTTP/1 requests containing an unbounded number of small, valid header fields. The HTTPDecoder previously enforced only an 80 KB per-field limit with no cap on cumulative header block size or field count, letting hundreds of thousands of headers accumulate before application code runs. No public exploit identified at time of analysis, but the attack is trivial and impacts any HTTP/1 server or client built on NIOHTTP1, including downstream frameworks like Hummingbird 2 (crashes) and Vapor 4 (memory inflation).

Technical ContextAI

SwiftNIO is Apple's event-driven, non-blocking network application framework for Swift, widely used as the foundation for Swift server-side ecosystems including Vapor and Hummingbird. The NIOHTTP1 module's HTTPDecoder is the channel handler responsible for parsing inbound HTTP/1.x byte streams into HTTPHeaders structures before they are surfaced to user code as HTTPServerRequestPart.head or HTTPClientResponsePart.head events. The CWE-400 (Uncontrolled Resource Consumption) root cause is the absence of two parsing bounds: a cumulative header-list size cap and a header-field-count cap - only a single per-field 80 KB ceiling existed. Because each individual header can stay well below 80 KB while the aggregate grows without bound, the decoder appends every field into HTTPHeaders before any handler can reject the request, and downstream bridges into swift-http-types' HTTPFields can additionally trigger precondition failures that abort the process. CPE pkg:swift/github.com_apple_swift-nio identifies the affected Swift package.

RemediationAI

Vendor-released patch: swift-nio 2.100.0 - upgrade the swift-nio package dependency to 2.100.0 or later, which introduces the NIOHTTPDecoderLimitConfiguration type with conservative defaults (maxHeaderFieldSize 80 KB, maxHeaderListSize 2 MB, maxHeaderFieldCount 256) that cause the decoder to fail with HTTPParserError.headerOverflow when exceeded; applications exchanging legitimately large header blocks can opt into higher limits via a custom configuration passed to HTTPRequestDecoder/HTTPResponseDecoder or via decoderConfiguration on NIOUpgradableHTTPServerPipelineConfiguration / NIOUpgradableHTTPClientPipelineConfiguration. Consult the advisory at https://github.com/apple/swift-nio/security/advisories/GHSA-rj37-6j9x-74q6 for the configuration API. If upgrading is not immediately possible, place a reverse proxy (nginx, HAProxy, Envoy) in front of the service that enforces equivalent caps on total header bytes and header field count per request - note the trade-off that the proxy's limits must match or be tighter than what legitimate clients need, and clients sending oversized but valid header blocks will be rejected with 4xx responses.