What is the CVSS score of CVE-2026-64785?

CVE-2026-64785 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-64785?

Yes, a patch is available for CVE-2026-64785. Update the affected software to the latest version immediately.

Swift Nio Http2 CVE-2026-64785

EUVD-2026-48369 MEDIUM

HTTP Request/Response Smuggling (CWE-444)

2026-07-23 apple

GHSA-q3g2-m552-3r9c

Information Disclosure Apple Request Smuggling Swift Nio Http2

5.3

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Red Hat

5.3 LOW

qualitative

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 15:00 vuln.today

Analysis Generated

Jul 26, 2026 - 15:00 vuln.today

Patch available

Jul 23, 2026 - 23:03 EUVD

CVE Published

Jul 23, 2026 - 18:50 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 23, 2026 - 18:50 cve.org

MEDIUM 5.3

DescriptionCVE.org

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.

AnalysisAI

HTTP request smuggling in SwiftNIO HTTP/2 allows unauthenticated remote attackers to inject headers or split responses via crafted HTTP/2 HEADERS frames that pass control characters through the HTTP/2-to-HTTP/1.1 codec. The vulnerability, caused by missing CR/LF/NUL/SP validation in regular header values and pseudo-headers, can be exploited when outbound validation is disabled or headers are forwarded without rechecking. Fixed in version 1.45.0; no public exploit identified at time of analysis and EPSS score is 0.14% (low).