5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23886

CVE-2026-23886: Swift W3C TraceContext vulnerable to a malformed HTTP header causing a crash

Impact

A denial-of-service vulnerability due to improper input validation allows a remote attacker to crash the service via a malformed HTTP header.

Allows crashing the process with data coming from the network when used with, for example, an HTTP server. Most common way of using Swift W3C Trace Context is through Swift OTel.

Patches

https://github.com/swift-otel/swift-w3c-trace-context/commit/5da9b143ba6046734de3fa51dafea28290174e4e

Workarounds

Disable either Swift OTel or the code that extracts the trace information from an incoming header (such as a TracingMiddleware).

References

Swift W3C TraceContext 1.0.0-beta.5 Swift OTel 1.0.4

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23886

CVE-2026-23886:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/swift-otel/swift-w3c-trace-context	swift	< 1.0.0-beta.5	1.0.0-beta.5
github.com/swift-otel/swift-otel	swift	< 1.0.4	1.0.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the swift-w3c-trace-context package, where improper input validation of the W3C traceparent HTTP header can lead to a denial-of-service. The root cause is in the Hex.convert function, which is responsible for converting hexadecimal strings to bytes. Prior to the patch, this function would only accept lowercase hexadecimal characters (0-9, a-f). If it encountered any other character, such as an uppercase letter, it would call preconditionFailure(), causing the entire service to crash.

The primary public-facing function that triggers this vulnerability is the TraceContext.init(traceParentHeaderValue:) initializer. This function takes the raw traceparent header value as input and passes substrings of it to the Hex.convert function to extract the traceID, spanID, and traceFlags. A remote attacker could craft a traceparent header with uppercase hexadecimal characters, which, when processed by a server using the vulnerable library (e.g., via Swift OTel), would trigger the crash.

The patch addresses this by modifying Hex.convert to throw a TraceParentDecodingError.invalidCharacter instead of crashing. Consequently, the TraceContext.init(traceParentHeaderValue:) initializer was updated to handle this potential error using try, thus preventing the denial-of-service.

Vulnerable functions

Hex.convert

Sources/W3CTraceContext/Hex.swift

The `Hex.convert` function was responsible for parsing hexadecimal characters from the `traceparent` header. Before the patch, if it encountered a non-lowercase hexadecimal character, it would call `preconditionFailure()`, which immediately terminates the process, leading to a denial of service. The vulnerability lies in the fact that it did not properly validate and handle invalid characters, instead opting to crash.

TraceContext.init(traceParentHeaderValue:)

Sources/W3CTraceContext/TraceContext.swift

This initializer is the entry point for parsing the `traceparent` header. It directly calls the vulnerable `Hex.convert` function to process the trace ID, span ID, and trace flags from the header string. As it was the caller of the function that crashed, it would appear in any runtime profile or stack trace when the vulnerability is triggered by a malformed header.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-23886: Swift W3C TraceContext vulnerable to a malformed HTTP header causing a crash

Impact

Patches

Workarounds

References

CVE-2026-23886:

5.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2026-23886: Swift W3C TraceContext vulnerable to a malformed HTTP header causing a crash

Impact

Patches

Workarounds

References

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

5.3

5.3

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI