CVE-2026-43678
An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, …
Published: 2026-08-20 · CVSS: 5.3 · CVSS 3.1
An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7