Live › vulnerability › CVE-2026-86983
Go to dashboardThe P-384 VOPRF API in swift-crypto does not bound the length of input it accepts. A remote attacker who can pass attacker-controlled data into that API can terminate the process that handles it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 23:35 UTC. All times on this page are UTC.
Applications built with swift-crypto that pass attacker-supplied input to the P-384 VOPRF API are exposed, because an oversized input can terminate the process. Services that never call the VOPRF API with external data are unlikely to be reached by this flaw. Teams that do not use swift-crypto's VOPRF functions can skip it.
No product ranges from the sources yet.
swift-crypto in Package.resolved or the dependency graph and read the resolved version.swift-crypto to 5.0.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-86983")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.