Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L N N U H N H 7.7 .0011 1.1 —
AFFECTED Product Versions Fixed swift-nio-ssl unspecified —
TIMELINE May 1 Reserved by apple Jul 23 Published (CNA: apple) Sep 4 EXPLOIT PUBLISHED — CVE-2026-43820 (Apple swift-nio-ssl). Public exploit reference added.
NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2.
| Date | Event | Detail |
|---|---|---|
| May 1, 2026 | Reserved | Reserved by apple |
| July 23, 2026 | Published | Published (CNA: apple) |
| September 4, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-43820 (Apple swift-nio-ssl). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Apple | swift-nio-ssl | — | — | — |
Authoritative record: CVE-2026-43820 at cve.org
Vendors: apple
Weaknesses: CWE-125
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43820 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
