Is CVE-2026-43678 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-43678?

CVE-2026-43678 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-43678

Description

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.