5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28898

CVE-2026-28898: SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec

swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status) at both the HPACK header validation layer and the HTTP/2-to-HTTP/1.1 translation layer. Requests or responses containing CR, LF, or NUL bytes in any pseudo-header value are now rejected with a connection error. This issue is fixed in swift-nio-http2 1.44.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28898

CVE-2026-28898:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/apple/swift-nio-http2	swift	< 1.44.1	1.44.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a request smuggling issue in swift-nio-http2 where the HTTP/2 to HTTP/1.1 codec fails to validate control characters (CR, LF, NUL) in HTTP/2 pseudo-headers like :path. An attacker can send a crafted HTTP/2 request with these characters in a pseudo-header. When the swift-nio-http2 server, acting as a reverse proxy, translates this to an HTTP/1.1 request, the control characters are not sanitized. This allows the attacker to inject new headers or even a new, "smuggled" HTTP/1.1 request into the backend server's request stream.

The analysis of the patch 61d1b44f6e4e118792be1cff88ee2bc0267c6f9a reveals the fix. The core of the fix is the introduction of the HPACKHeaders.isValidPseudoHeaderValue function, which checks for the forbidden characters.

This new validation is applied in two key places:

HPACKHeaders.validateRequestBlock(supportsExtendedConnect:): This function is responsible for validating incoming request headers. The patch adds a check to ensure pseudo-header values are validated. Before the patch, this validation was missing.
HPACKHeaders.validateAndExtractPseudoHeader(name:as:): This function extracts pseudo-header values. The patch adds a call to isValidPseudoHeaderValue to validate the value before returning it.

The main entry point for processing incoming data in the vulnerable component is the channelRead method of HTTP2FramePayloadToHTTP1ServerCodec. This function receives the HTTP/2 frames containing the malicious headers and would initiate the call chain leading to the vulnerable validation functions. Therefore, channelRead would appear in a runtime profile during exploitation.

Vulnerable functions

NIOHTTP2.HTTP2FramePayloadToHTTP1ServerCodec.channelRead

Sources/NIOHTTP2/HTTP2FramePayloadToHTTP1ServerCodec.swift

This is the primary entry point in the server codec that receives incoming HTTP/2 frames. When a frame with malicious pseudo-headers is received, this function initiates the header processing pipeline which, prior to the patch, lacked the necessary validation, leading to the vulnerability.

NIOHTTP2.HPACKHeaders.validateRequestBlock

Sources/NIOHTTP2/HPACKHeaders+Validation.swift

This function is responsible for validating a block of request headers. The vulnerability existed because this function failed to inspect the values of pseudo-headers for control characters. The patch adds a specific check for pseudo-header fields to validate their values using the new `isValidPseudoHeaderValue` function.

NIOHTTP2.HPACKHeaders.validateAndExtractPseudoHeader

Sources/NIOHTTP2/HTTP2ToHTTP1Codec.swift

This function is used to extract the value of a specific pseudo-header from a header block. Prior to the patch, it would extract the value without validating its contents. The patch adds a call to `isValidPseudoHeaderValue` to ensure the value is safe before it is returned and used in the translated HTTP/1.1 request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.