Correct affected versions of CVE-2026-28898 to <1.44.0
- Dominant language
- Swift
- Stars
- 503
- Forks
- 103
- Avg merge
- 18h 8m
- Merged PRs (30d)
- 4
Description
The affected-version range for CVE-2026-28898 / GHSA-4px2-pw77-vc85 is incorrect in the CVE List and NVD records. The vulnerability was fixed in `1.44.0`, so the correct affected range is `< 1.44.0`. Because `1.44.0` is the latest release, the incorrect ranges mark all versions as vulnerable, so every adopter of swift-nio-http2 is being reported as affected.
## Correct range
The vulnerability was fixed in `1.44.0`: https://github.com/apple/swift-nio-http2/compare/1.43.0...1.44.0, so the correct affected range is `< 1.44.0`.
## State across databases
| Record | Affected range | Status |
| --- | --- | --- |
| [Repo source advisory](https://github.com/apple/swift-nio-http2/security/advisories/GHSA-4px2-pw77-vc85) | `< 1.34.1` | ❌ incorrect |
| [GitHub Advisory Database](https://github.com/advisories/GHSA-4px2-pw77-vc85) | `< 1.44.0` | ✅ corrected in [github/advisory-database#8277](https://github.com/github/advisory-database/pull/8277) |
| [CVE List](https://www.cve.org/CVERecord?id=CVE-2026-28898) | `< 1.44.1` (`<= 1.44.0`) | ❌ incorrect |
| [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-28898) | `< 1.44.1` (`<= 1.44.0`) | ❌ incorrect |
The public GitHub Advisory Database entry has already been corrected to `< 1.44.0`, but the repo source advisory still lists `< 1.34.1`.
## Request
1. Repo source advisory: please update the affected range from `< 1.34.1` to `< 1.44.0`. This should protect the GitHub Advisory Database entry from regressing.
2. CVE record: Apple being the assigning CNA for CVE-2026-28898, please revise the range from `< 1.44.1` to `< 1.44.0` upstream onto CVE List and NVD.
Thank you!
Contributor guide
Research direction
Start with the linked repo source advisory for GHSA-4px2-pw77-vc85 and compare its affected range with the corrected GitHub Advisory Database entry. Update the repository record from < 1.34.1 to < 1.44.0; the CVE List and NVD changes require Apple, as the assigning CNA, to revise the upstream CVE record.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100