Apple Swiftnio vulnerabilities

11 CVEs affecting Apple Swiftnio, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-43678, published 2026-08-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-9515, published 2019-08-13. High severity, CVSS 7.5. EPSS: 87.4% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the…
CVE-2019-9512, published 2019-08-13. High severity, CVSS 7.5. EPSS: 83.4% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal…
CVE-2019-9514, published 2019-08-13. High severity, CVSS 7.5. EPSS: 82.8% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that…
CVE-2019-9513, published 2019-08-13. High severity, CVSS 7.5. EPSS: 81.6% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the…
CVE-2019-9511, published 2019-08-13. High severity, CVSS 7.5. EPSS: 59.5% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data…
CVE-2019-9516, published 2019-08-13. Medium severity, CVSS 6.5. EPSS: 56.3% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value,…
CVE-2019-9517, published 2019-08-13. High severity, CVSS 7.5. EPSS: 27.9% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without…
CVE-2019-9518, published 2019-08-13. High severity, CVSS 7.5. EPSS: 25.4% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the…
CVE-2018-4281, published 2019-01-11. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. In SwiftNIO before 1.8.0, a buffer overflow was addressed with improved size validation.
CVE-2022-3215, published 2022-09-28. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming…

Latest

CVE-2026-43678, published 2026-08-20. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active…