CVE-2026-86983

CVSS 5.9 (medium) · published 2026-10-28

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.

Weakness: CWE-20

Source: NVD CVE-2026-86983

References

• https://github.com/apple/swift-crypto/security/advisories/GHSA-jwv7-rv4f-rff2

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.