{"id":"CVE-2026-86983","kind":"vulnerability","aliases":["CVE-2026-86983"],"related":[],"title":"swift-crypto: unbounded input to P-384 VOPRF API can crash a process","description":"A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.","summary":"The P-384 VOPRF API in swift-crypto does not bound the length of input it accepts. A remote attacker who can pass attacker-controlled data into that API can terminate the process that handles it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","server-side","swift","swift-crypto"],"not_affected_if":["no-voprf-usage"],"how_to_check":"- Look for `swift-crypto` in `Package.resolved` or the dependency graph and read the resolved version.\n- Check whether the code calls the P-384 VOPRF API with data that arrives from outside the service.","fix":"- Upgrade `swift-crypto` to `5.0.3` or later.\n- Until upgraded, unknown for a workaround: the sources do not say.","status":"open","published_at":"2026-10-28T23:17:11+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","triaged_at":"2026-10-28T23:36:44+00:00","updated_at":"2026-10-28T23:36:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T23:36:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `swift-crypto` to `5.0.3` or later.\n- Until upgraded, unknown for a workaround: the sources do not say.","reach":"internet","title":"swift-crypto: unbounded input to P-384 VOPRF API can crash a process","impact":"low","summary":"The P-384 VOPRF API in swift-crypto does not bound the length of input it accepts. A remote attacker who can pass attacker-controlled data into that API can terminate the process that handles it.","category":"package","nicknames":[],"who_cares":["swift","swift-crypto","server-side"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker terminates the process handling the request, causing denial of service.","analyst_note":"Check the NVD entry and the swift-crypto 5.0.3 release notes to confirm the exposure path and whether a workaround exists.","how_to_check":"- Look for `swift-crypto` in `Package.resolved` or the dependency graph and read the resolved version.\n- Check whether the code calls the P-384 VOPRF API with data that arrives from outside the service.","needs_analyst":true,"not_affected_if":["no-voprf-usage"],"who_is_affected":"Applications built with swift-crypto that pass attacker-supplied input to the P-384 VOPRF API are exposed, because an oversized input can terminate the process. Services that never call the VOPRF API with external data are unlikely to be reached by this flaw. Teams that do not use swift-crypto's VOPRF functions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000614,"input_tokens":3281,"output_tokens":571,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-384':8A,31B,85C '-86983':17A,20A '5.0.3':101C 'abl':71C 'accept':46B 'address':95C 'api':10A,33B,59B,87C 'attack':49B,54B,68C,79C 'attacker-control':53B,78C 'bound':40B,89C 'control':55B,80C 'crash':12A 'crypto':3A,28B,37B,99C 'cve':15A,18A 'data':56B 'handl':65B 'input':5A,44B,81C 'length':42B,91C 'may':69C 'p':7A,30B,84C 'packag':21B 'pass':52B,77C 'process':14A,63B,75C 'remot':48B,67C 'server':23B 'server-sid':22B 'side':24B 'swift':2A,25B,27B,36B,98C 'swift-crypto':1A,26B,35B,97C 'termin':61B,73C 'unbound':4A 'version':100C 'voprf':9A,32B,86C 'vulner':93C 'without':88C","nicknames":[],"mitigations":[],"who_affected":"Applications built with swift-crypto that pass attacker-supplied input to the P-384 VOPRF API are exposed, because an oversized input can terminate the process. Services that never call the VOPRF API with external data are unlikely to be reached by this flaw. Teams that do not use swift-crypto's VOPRF functions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T23:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86983","severity":null,"published_at":"2026-10-28T23:17:11+00:00","modified_at":"2026-10-28T23:17:11+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","fetched_at":"2026-10-28T23:35:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}