An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active co…

Medium CVSS 5.3

CVECVE-2026-43678

First seen2026-08-20 20:31 UTC

Disclosed2026-08-20 19:16 UTC

Last updated2026-08-20 20:31 UTC

Channel statusauto

Summary

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://github.com/apple/container/security/advisories/GHSA-2v2q-4q35-h585

Timeline

2026-08-20 nvd_ingest NVD