apple / apple/swift-nio-http2

Correct affected versions of CVE-2026-28898 to <1.44.0

Open
#556 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Swift
Stars
503
Forks
103
Avg merge
18h 8m
Merged PRs (30d)
4

Description

The affected-version range for CVE-2026-28898 / GHSA-4px2-pw77-vc85 is incorrect in the CVE List and NVD records. The vulnerability was fixed in `1.44.0`, so the correct affected range is `< 1.44.0`. Because `1.44.0` is the latest release, the incorrect ranges mark all versions as vulnerable, so every adopter of swift-nio-http2 is being reported as affected.

## Correct range

The vulnerability was fixed in `1.44.0`: https://github.com/apple/swift-nio-http2/compare/1.43.0...1.44.0, so the correct affected range is `< 1.44.0`.

## State across databases

| Record | Affected range | Status |
| --- | --- | --- |
| [Repo source advisory](https://github.com/apple/swift-nio-http2/security/advisories/GHSA-4px2-pw77-vc85) | `< 1.34.1` | ❌ incorrect |
| [GitHub Advisory Database](https://github.com/advisories/GHSA-4px2-pw77-vc85) | `< 1.44.0` | ✅ corrected in [github/advisory-database#8277](https://github.com/github/advisory-database/pull/8277) |
| [CVE List](https://www.cve.org/CVERecord?id=CVE-2026-28898) | `< 1.44.1` (`<= 1.44.0`) | ❌ incorrect |
| [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-28898) | `< 1.44.1` (`<= 1.44.0`) | ❌ incorrect |

The public GitHub Advisory Database entry has already been corrected to `< 1.44.0`, but the repo source advisory still lists `< 1.34.1`.

## Request

1. Repo source advisory: please update the affected range from `< 1.34.1` to `< 1.44.0`. This should protect the GitHub Advisory Database entry from regressing.
2. CVE record: Apple being the assigning CNA for CVE-2026-28898, please revise the range from `< 1.44.1` to `< 1.44.0` upstream onto CVE List and NVD.

Thank you!

Contributor guide

Open the contributing guide

Research direction

Start with the linked repo source advisory for GHSA-4px2-pw77-vc85 and compare its affected range with the corrected GitHub Advisory Database entry. Update the repository record from < 1.34.1 to < 1.44.0; the CVE List and NVD changes require Apple, as the assigning CNA, to revise the upstream CVE record.

Written by the indexing model from the issue text.

Assessment

Tech stack
swift
Domain
security
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.