Swift Crypto

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:apple:swift-crypto:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorApple (c2b419d0-9f0f-51c1-88dc-2e204a98e1c7)
ProductSwift Crypto (bdfe262f-df97-5a99-8950-c5a3d5461bfa)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/apple/swift-crypto purl2cpe 2026-06-01 10:12:26.299027

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-86983 vulnerable 2026-11-03 10:16:04.125474 Details available
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.
Published: 2026-10-28T23:01:59.598Z
Updated: 2026-11-04T16:27:11.072Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-43823 vulnerable 2026-07-29 00:52:13.878615 Details available
When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.
Published: 2026-07-23T14:33:20.924Z
Updated: 2026-07-23T18:12:10.258Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.