CVE-2026-43678 PUBLISHED

Assigner: apple
Reserved: 01.05.2026 Published: 20.08.2026 Updated: 20.08.2026

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.

Product Status

Vendor	Apple
Product	swift-nio
Versions	affected from 0 to 2.101.0 (excl.)

References

https://github.com/apple/swift-nio/security/advisories/GHSA-qcc5-f287-vgmq

Problem Types

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts.