crítica
GHSA-mgc4-wqv7-4pxm
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA.
Descripción
### Impact Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues. This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module. ### Workarounds No workaround is available, users must upgrade. ### References https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| cocoapods::GitHub Security Advisory Swift | CNIOAtomics, CNIODarwin, CNIOHTTPParser y 29 más | 1.14.2, 2.13.1 |
| swift::GitHub Security Advisory Swift | github.com/apple/swift-nio | 1.14.2, 2.13.1 |
Mostrar las 33 entradas de 2 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| cocoapods::GitHub Security Advisory Swift | CNIOAtomics | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIODarwin | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOHTTPParser | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOLinux | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOSHA1 | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOWindows | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOZlib | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | NIOConcurrencyHelpers | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIO | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOChatClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOChatServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOConcurrencyHelpers | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOCore | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEchoClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEchoServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEmbedded | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOFoundationCompat | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1 | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1Client | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1Server | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOMulticastChat | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOPerformanceTester | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOPosix | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOTLS | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOTestUtils | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOUDPEchoClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOUDPEchoServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocket | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocketClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocketServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | _NIOConcurrency | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | _NIODataStructures | 1.14.2, 2.13.1 |
| swift::GitHub Security Advisory Swift | github.com/apple/swift-nio | 1.14.2, 2.13.1 |
Referencias
- https://github.com/apple/swift-nio
- https://github.com/apple/swift-nio/commit/8da5c5a4e6c5084c296b9f39dc54f00be146e0fa
- https://github.com/apple/swift-nio/commit/bfde40cac8eca25ce021552513b20ee23fc6e306
- https://github.com/apple/swift-nio/commit/df9390006bce7da1b6273f804d3acbbfdfcc6154
- https://github.com/apple/swift-nio/commit/f94b22b506e3557cb1b325534fa9bbcd39c90246
- https://github.com/apple/swift-nio/pull/1387
- https://github.com/apple/swift-nio/pull/1388
- https://github.com/apple/swift-nio/security/advisories/GHSA-mgc4-wqv7-4pxm