CVE-2026-43678

CVE-2026-43678 is a denial-of-service vulnerability in swift-nio's WebSocket implementation, version 2.101.0 addresses it. An unauthenticated attacker can send a specifically crafted 11-byte WebSocket frame after the handshake completes and cause the entire process to terminate, dropping all active connections. The CVSS 5.3 score is misleading—this is not a benign bug. The blast radius is the critical dimension the score doesn't capture: a single malformed frame from one peer kills every unrelated user connected to that process. For services with long-lived WebSocket connections—a common pattern in real-time applications built on Vapor or Hummingbird—this becomes a targeted connection-wiping mechanism rather than a mere crash bug. The vulnerability exists because post-handshake frame parsing was treated as routine data from a trusted peer. The WebSocket handshake is the expensive, careful operation where you verify the peer is worth engaging with; everything after that is supposed to be boring. Swift-nio relaxed its adversarial posture after the handshake, treating frames as implicitly safe when they're actually the most dangerous attack surface precisely because they're supposed to be mundane. This is a pattern that recurs across WebSocket implementations—every few years a different library shows this exact failure mode. Prioritisation depends on your exposure. If you're running a service with active WebSocket connections, this patch demands urgency regardless of the low EPSS score. The EPSS number reflects the present moment—it will not stay low once exploit code circulates, and the coordination window between swift-nio releasing 2.101.0 and downstream frameworks pulling it into production is where real exposure lives. Monitor your release channels for Vapor and Hummingbird updates and apply them promptly. The question you should be asking isn't whether to patch—it's whether other protocol handlers in your swift-nio dependency tree (HTTP/2, QUIC) have similar "post-handshake is boring" assumptions lurking in code that stopped getting security scrutiny years ago.

Reviewed through automated stages and approved by a human before publication.