CVE-2026-23886 is a medium severity vulnerability with a CVSS score of 5.3. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
A denial-of-service vulnerability due to improper input validation allows a remote attacker to crash the service via a malformed HTTP header.
Allows crashing the process with data coming from the network when used with, for example, an HTTP server. Most common way of using Swift W3C Trace Context is through Swift OTel.
https://github.com/swift-otel/swift-w3c-trace-context/commit/5da9b143ba6046734de3fa51dafea28290174e4e
Disable either Swift OTel or the code that extracts the trace information from an incoming header (such as a TracingMiddleware).
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.