critique
GHSA-mgc4-wqv7-4pxm
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon GHSA.
Description
### Impact Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues. This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module. ### Workarounds No workaround is available, users must upgrade. ### References https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| cocoapods::GitHub Security Advisory Swift | CNIOAtomics, CNIODarwin, CNIOHTTPParser et 29 autres | 1.14.2, 2.13.1 |
| swift::GitHub Security Advisory Swift | github.com/apple/swift-nio | 1.14.2, 2.13.1 |
Afficher les 33 entrées de 2 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| cocoapods::GitHub Security Advisory Swift | CNIOAtomics | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIODarwin | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOHTTPParser | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOLinux | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOSHA1 | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOWindows | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOZlib | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | NIOConcurrencyHelpers | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIO | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOChatClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOChatServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOConcurrencyHelpers | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOCore | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEchoClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEchoServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEmbedded | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOFoundationCompat | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1 | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1Client | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1Server | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOMulticastChat | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOPerformanceTester | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOPosix | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOTLS | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOTestUtils | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOUDPEchoClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOUDPEchoServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocket | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocketClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocketServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | _NIOConcurrency | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | _NIODataStructures | 1.14.2, 2.13.1 |
| swift::GitHub Security Advisory Swift | github.com/apple/swift-nio | 1.14.2, 2.13.1 |
Références
- https://github.com/apple/swift-nio
- https://github.com/apple/swift-nio/commit/8da5c5a4e6c5084c296b9f39dc54f00be146e0fa
- https://github.com/apple/swift-nio/commit/bfde40cac8eca25ce021552513b20ee23fc6e306
- https://github.com/apple/swift-nio/commit/df9390006bce7da1b6273f804d3acbbfdfcc6154
- https://github.com/apple/swift-nio/commit/f94b22b506e3557cb1b325534fa9bbcd39c90246
- https://github.com/apple/swift-nio/pull/1387
- https://github.com/apple/swift-nio/pull/1388
- https://github.com/apple/swift-nio/security/advisories/GHSA-mgc4-wqv7-4pxm