CVE-2026-43678

Apple / swift-nio PUBLISHED

Description (CNA)

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.

Affected (CNA)

Vendor / product	Versions
Apple / swift-nio	affected 0 before 2.101.0

CWE

No CWE identifiers supplied.

References

https://github.com/apple/swift-nio/security/advisories/GHSA-qcc5-f287-vgmq

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.