Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / GHSA-mgc4-wqv7-4pxm

kritik

GHSA-mgc4-wqv7-4pxm

SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header

Yayın Değişiklik
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: GHSA.

Açıklama

### Impact Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues. This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module. ### Workarounds No workaround is available, users must upgrade. ### References https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
cocoapods::GitHub Security Advisory SwiftCNIOAtomics, CNIODarwin, CNIOHTTPParser ve 29 tane daha1.14.2, 2.13.1
swift::GitHub Security Advisory Swiftgithub.com/apple/swift-nio1.14.2, 2.13.1
2 kaynaktaki 33 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
cocoapods::GitHub Security Advisory SwiftCNIOAtomics1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftCNIODarwin1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftCNIOHTTPParser1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftCNIOLinux1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftCNIOSHA11.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftCNIOWindows1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftCNIOZlib1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftNIOConcurrencyHelpers1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIO1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOChatClient1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOChatServer1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOConcurrencyHelpers1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOCore1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOEchoClient1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOEchoServer1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOEmbedded1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOFoundationCompat1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOHTTP11.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOHTTP1Client1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOHTTP1Server1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOMulticastChat1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOPerformanceTester1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOPosix1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOTLS1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOTestUtils1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOUDPEchoClient1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOUDPEchoServer1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOWebSocket1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOWebSocketClient1.14.2, 2.13.1
cocoapods::GitHub Security Advisory SwiftSwiftNIOWebSocketServer1.14.2, 2.13.1
cocoapods::GitHub Security Advisory Swift_NIOConcurrency1.14.2, 2.13.1
cocoapods::GitHub Security Advisory Swift_NIODataStructures1.14.2, 2.13.1
swift::GitHub Security Advisory Swiftgithub.com/apple/swift-nio1.14.2, 2.13.1

Referanslar

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.