Hello, security blog. Back like I never left.
Recently, I was exploring the Apple ecosystem trying my best to learn more about the Swift programming language. As of late (as you can see), I've become a big fan of MacOS/iOS/etc, and have been interested in learning more.
A few days later, I ended up with a CVE somehow. Isn't it funny how things work?
To put it simply, what we have with CVE-2026-28975, is a vulnerability within the decompression functionality of SwiftNIO Extras.
The code reads the response’s Content-Length header and uses that attacker-controlled value to calculate the decompression ratio, meaning an inflated header could make a dangerous expansion appear safely below the configured limit.
Here's the advisory along with some other links relating to the CVE:
Advisory: https://github.com/apple/swift-nio-extras/security/advisories/GHSA-6ph5-fww6-vfwv
Feedly: https://feedly.com/cve/CVE-2026-28975
It's pretty nice to have an actual contribution to the Apple ecosystem that I can point to and say "Hey I did that btw" (humblebrag)
In any case, I don't have much to say other than the fact that I thought this was cool and I need to get back in the computing gym and do more work.
I have another post to make today then I'll probably disappear for a month.
Hope not though!