Skip to content

SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header

Critical severity GitHub Reviewed Published Feb 17, 2020 in apple/swift-nio • Updated Jun 19, 2023

Package

swift github.com/apple/swift-nio (Swift)

Affected versions

>= 1.0.0, < 1.14.2
>= 2.0.0, < 2.13.1

Patched versions

1.14.2
2.13.1

Description

Impact

Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.

This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the NIOHTTP1 module.

Workarounds

No workaround is available, users must upgrade.

References

https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605

References

@Lukasa Lukasa published to apple/swift-nio Feb 17, 2020
Published to the GitHub Advisory Database May 18, 2023
Reviewed May 18, 2023
Last updated Jun 19, 2023

Severity

Critical
9.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-mgc4-wqv7-4pxm

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.