External risk intelligence

Swift-NIO-SSH Stack Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-43798

The vulnerability affects swift-nio-ssh, a developer library. While it enables critical unauthenticated network attacks, exposure depends on whether the consuming application exposes an SSH interface to the network. It is not an inherent property of the library itself, but rather contingent on the specific deployment and implementation of the software using this component.

Apple Swiftnio Ssh

before 0.14.1

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in swift-nio-ssh could allow an unauthenticated attacker to remotely execute code by sending a specially crafted network message. This issue impacts applications built using the swift-nio-ssh library. The main concern at this stage is to confirm whether any of our deployed applications utilize this specific library and, if so, assess the exposure risk.

Unauthenticated network attackers can exploit this.
Understanding application use of this library is key.
Confirm relevance and potential exposure to this risk.

Attack Path

How an attacker could exploit the issue

An attacker can target any application using the swift-nio-ssh library by sending a specially crafted SSH message over the network. This message can cause an out-of-bounds write on the stack, potentially allowing the attacker to execute arbitrary code.

Unauthenticated network access is required.
A single crafted SSH message triggers the vulnerability.
Leads to unauthorized code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated network attacker to execute arbitrary code or cause a denial of service on applications built with swift-nio-ssh. This is possible when a specially crafted SSH message triggers an out-of-bounds stack write, potentially impacting system integrity and availability.

Arbitrary code execution or denial of service.
Network-based crafted SSH message.
System compromise or unavailability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The swift-nio-ssh library's vulnerability to unauthenticated network attacks impacts applications using it for SSH functionality. Responsible teams, likely including application owners and platform engineers, must first identify deployments of this library, assess their network exposure, and confirm business criticality. A risk-based remediation plan, coordinated with vendors if necessary, should then be developed.

Application owners and platform teams
Verify network exposure and business criticality
Plan remediation based on identified risk

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the swift-nio-ssh library?

Swift-nio-ssh is a modular, event-driven network application framework used by developers to implement the SSH protocol within software written in the Swift programming language. It serves as the building block for applications that need to provide secure remote access or data transfer capabilities. If you are running an application that enables SSH-based connectivity, it may be relying on this library to manage those encrypted network sessions.

Why is CVE-2026-43798 considered an out-of-bounds stack write?

This vulnerability falls under the CWE-121 weakness class, known as a stack-based buffer overflow. It occurs when a program writes data beyond the intended boundaries of a memory buffer located on the stack. In the context of CVE-2026-43798, a specifically formatted SSH message forces the library to write data into memory areas it should not access, which can overwrite critical program instructions and allow an attacker to hijack the application's execution flow.

How does an attacker trigger this vulnerability?

The flaw is triggered when an unauthenticated attacker sends a single, malformed SSH message to an application that uses the vulnerable library. Because the bug resides in how the library parses these messages, it does not require a valid user login or any established credentials to execute. Simply attempting to initiate or interact with the SSH service is sufficient to reach the vulnerable code path.

Is my application at risk if it uses swift-nio-ssh?

Halo Surface Signal indicates that while the library is inherently vulnerable, the actual risk depends on your specific deployment. Your application is only susceptible if it exposes an SSH interface directly to a network where an attacker can send traffic. If your implementation of the library is restricted to internal, non-network-facing functions, the threat is significantly lower, though it remains a concern for overall system security.

What should I do if I use this library?

Your first step is to perform a software inventory to locate any applications or services currently utilizing swift-nio-ssh. Once identified, prioritize those that are network-accessible for review. The primary fix is to update your project's dependency to version 0.14.1 or later, where this vulnerability has been addressed. Coordinate with your engineering teams to test and deploy this update to ensure your environment is no longer susceptible to these crafted network messages.

References

github.com/apple/swift-nio-ssh/security/advisories/GHSA-998x-vgv…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.