Swift vulnerabilities and fixes

CVEs that mention Swift, ranked by priority. 7 tracked.

Swift has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-08-05. Highest priority: CVE-2026-71190 (score 50/100).

• CVE-2026-71190 HIGH 8.7 In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnera
• CVE-2026-43823 HIGH 7.5 UPGRADE When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: firs
• CVE-2026-71191 MEDIUM 6.0 In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered
• CVE-2026-43820 HIGH 7.7 UPGRADE NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs
• CVE-2026-71192 MEDIUM 6.0 In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy
• CVE-2026-64785 MEDIUM 5.3 UPGRADE SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control ch
• CVE-2026-18718 HIGH 7.0 Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attac

FAQ

How do I fix Swift vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Swift being exploited right now?

None of the tracked Swift CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Swift CVE should I patch first?

CVE-2026-71190 currently ranks highest (50/100): In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnera.

← Back to latest CVEs