CVE-2026-28980

### Summary The `HTTPDecoder` in `NIOHTTP1` enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fields per message. A remote peer can submit an arbitrary number of small, valid headers in a single request and have them all accumulated into the resulting `HTTPHeaders` value before any application code runs. This can be used to exhaust memory, or — for consumers that subsequently convert headers into `swift-http-types`' `HTTPFields` — to crash the process. ### Details `HTTPDecoder` previously enforced only a single hardcoded parsing limit: 80 KB per individual header field (name + value). There was no cap on the cumulative size of the header block, nor on the number of header fields per message. Because each individual field can remain well below the 80 KB threshold, a peer can submit hundreds of thousands of valid headers in a single request, all of which are appended to the decoded `HTTPHeaders` without bound. The headers are then visible to user code through the standard `HTTPServerRequestPart.head` / `HTTPClientResponsePart.head` events. Two observed downstream effects: - **Hummingbird 2** (and other consumers that bridge `HTTPHeaders` into `swift-http-types`' `HTTPFields`) crashes via a precondition failure inside `HTTPFields` once the configured field count is exceeded. - **Vapor 4** does not crash, but the per-request memory footprint scales linearly with the number of headers received, allowing a single connection to inflate server memory use substantially. ### Impact A single unauthenticated remote peer can trigger a denial of service against any HTTP/1 server (or, in the response direction, any HTTP/1 client) built on `NIOHTTP1` — either by crashing the process, depending on the downstream framework, or by driving the process's resident memory to arbitrary sizes. ### Patches This issue is addressed in `swift-nio` 2.100.0 and later. The `HTTPDecoder` now applies three parsing limits with conservative defaults, exposed through the new `NIOHTTPDecoderLimitConfiguration` type: | Limit | Default | | --- | --- | | `maxHeaderFieldSize` | 80 KB | | `maxHeaderListSize` | 2 MB | | `maxHeaderFieldCount` | 256 | Exceeding any of these limits causes the decoder to fail with `HTTPParserError.headerOverflow`. The configuration can be supplied directly to `HTTPRequestDecoder` / `HTTPResponseDecoder`, or via the `decoderConfiguration` property on `NIOUpgradableHTTPServerPipelineConfiguration` and `NIOUpgradableHTTPClientPipelineConfiguration`. Users who require larger limits — for example, applications that legitimately exchange very large header blocks — can opt into them explicitly by constructing a custom `NIOHTTPDecoderLimitConfiguration`. ### Workarounds Users unable to upgrade can mitigate by placing a reverse proxy in front of the service that enforces equivalent limits on request header count and total header size. ### Credit This issue was reported by @Joannis. SwiftNIO thanks @Joannis for the report and the support in landing the fix.

• CWE-400
• CWE-770

• https://github.com/advisories/GHSA-rj37-6j9x-74q6
• https://github.com/apple/swift-nio/security/advisories/GHSA-rj37-6j9x-74q6

Published

Jun 12, 2026

Last Modified

Jun 12, 2026

Status

GHSA

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28975### Impact When `NIOHTTPRequestDecompressor` is configured …6.9
• CVE-2026-28976An information leakage was addressed with additional validat…7.5
• CVE-2026-28977The issue was addressed with improved bounds checks. This is…6.2
• CVE-2026-28978A permissions issue was addressed with additional restrictio…8.8
• CVE-2026-28979An out-of-bounds access issue was addressed with improved bo…6.5
• CVE-2026-2898A vulnerability was detected in funadmin up to 7.1.0-rc4. Th…6.5
• CVE-2026-28981A buffer overflow was addressed with improved bounds checkin…7.8
• CVE-2026-28982A race condition was addressed with improved locking. This i…9.8
• CVE-2026-28983A type confusion issue was addressed with improved checks. T…7.5
• CVE-2026-28985A null pointer dereference was addressed with improved input…6.2
• CVE-2026-28986A race condition was addressed with additional validation. T…7.5
• CVE-2026-28987A logging issue was addressed with improved data redaction. …7.5