CVE-2026-86983

State: Published
Severity: Not scored
Published: Oct 28, 2026
Updated: Oct 28, 2026
Reserved: Sep 8, 2026

Description

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
swift-cryptoApple	before 5.0.3Affected

References

https://github.com/apple/swift-crypto/security/advisories/GHSA-jwv7-rv4f-rff2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.