🛡️ GHSA-xvr7-p2c6-j83w — swift-nio-http2

⚪ Unknown ✅ No Known Exploit CWE-405 OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

swift-nio-http2 affected by HTTP/2 MadeYouReset vulnerability

The HTTP/2 [MadeYouReset vulnerability](https://galbarnahum.com/made-you-reset) has a mild effect on swift-nio-http2.

swift-nio-http2 mostly protects against MadeYouReset by using a number of existing denial-of-service prevention patterns that we added in response to the RapidReset vulnerabilities. The result is that servers are not vulnerable to naive attacks based on MadeYouReset, and the naive PoC examples do not affect swift-nio-http2.

However, in 1.38.0 we added some defense-in-depth measures as a precautionary measure that detect clients behaving "weirdly". These defense in depth measures tackle resource drain attacks where attackers interleave attack traffic with legitimate traffic to try to evade our existing DoS prevention mechanisms.

We recommend all adopters move to 1.38.0 as soon as possible to mitigate against more sophisticated attacks that may appear in the future.

We are very grateful to @galbarnahum, @AnatBB, and @YanivRL for their reporting and assistance with our process.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. Rated impact: confidentiality none, integrity none, availability low.

Weakness class

GHSA-xvr7-p2c6-j83w is classified as CWE-405: Asymmetric Resource Consumption (Amplification). The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's…

Affected software

GHSA-xvr7-p2c6-j83w is recorded against 1 package.

  • github.com/apple/swift-nio-http2

Timeline and source

Published on 13 August 2025. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Package)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CWE CWE-405
Public Exploit ✅ No
Source OSV
Published 2025-08-13
Updated 2026-08-12
Modified 2025-08-13
Fix URL N/A

Affected Packages

Software From version Fixed in
github.com/apple/swift-nio-http2 — —

Free Vulnerability Check

Is your site affected by GHSA-xvr7-p2c6-j83w?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against GHSA-xvr7-p2c6-j83w and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesGitHub AdvisoryGitHub Advisory Undated