CVE-2026-43798: Apple Swiftnio SSH

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.

Affected products

• Apple Swiftnio SSH: before 0.14.1 (fixed in 0.14.1)

Published 2026-08-20. Last modified 2026-09-03.