CVE-2026-23886 json
Swift W3C TraceContext has malformed HTTP header that can cause a crash
published 9mo ago modified 4mo ago also EUVD-2026-3282 , GHSA-mvpq-2v8x-ww6g
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol (OTLP) backend for Swift Log, Swift Metrics, and Swift Distributed Tracing. Prior to Swift W3C TraceContext version 1.0.0-beta.5 and Swift OTel version 1.0.4, a denial-of-service vulnerability due to improper input validation allows a remote attacker to crash the service via a malformed HTTP header. This allows crashing the process with data coming from the network when used with, for example, an HTTP server. Most common way of using Swift W3C Trace Context is through Swift OTel. Version 1.0.0-beta.5 of Swift W3C TraceContext and version 1.0.4 of Swift OTel contain a patch for this issue. As a workaround, disable either Swift OTel or the code that extracts the trace information from an incoming header (such as a `TracingMiddleware`).
Patch / fix
- swift github.com/swift-otel/swift-w3c-trace-context 1.0.0-beta.5
- swift github.com/swift-otel/swift-otel 1.0.4
Is CVE-2026-23886 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9mo ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| swift | github.com/swift-otel/swift-w3c-trace-context | <1.0.0-beta.5 |
1.0.0-beta.5 |
| swift | github.com/swift-otel/swift-otel | <1.0.4 |
1.0.4 |
Affected products
- swift-otel swift-w3c-trace-context
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/swift-otel/swift-w3c-trace-context/commit/5da9b143ba6046734de3fa51dafea28290174e4e
web
-
github.com
/swift-otel/swift-w3c-trace-context/security/advisories/GHSA-mvpq-2v8x-ww6g
web
-
github.com
/swift-otel/swift-otel/releases/tag/1.0.4
web
-
github.com
/swift-otel/swift-w3c-trace-context/releases/tag/1.0.0-beta.5
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-23886
advisory
-
github.com
/swift-otel/swift-w3c-trace-context
package
Sources
- CVE List CVE-2026-23886
- GitHub Advisory GHSA-mvpq-2v8x-ww6g
- NVD CVE-2026-23886
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.