PT-2026-3508 · Unknown · Swift-W3C-Trace-Context+1

Czechboy0 · Published 2026-01-19 · Updated 2026-01-21 · CVE-2026-23886

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Swift W3C TraceContext versions prior to 1.0.0-beta.5 Swift OTel versions prior to 1.0.4

Description A flaw exists in Swift W3C TraceContext and Swift OTel due to insufficient input validation. This can lead to a denial-of-service condition, potentially crashing the service when processing malformed HTTP headers. The issue arises from data received over the network, such as when used with an HTTP server. A workaround involves disabling either Swift OTel or the code responsible for extracting trace information from incoming headers.

Recommendations Update Swift W3C TraceContext to version 1.0.0-beta.5 or later. Update Swift OTel to version 1.0.4 or later. As a temporary workaround, disable Swift OTel. As a temporary workaround, disable the code that extracts trace information from incoming headers.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-23886

GHSA-MVPQ-2V8X-WW6G

Affected Products

Swift Otel

Swift-W3C-Trace-Context

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23886.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-23886 · Security Note
• https://osv.dev/vulnerability/GHSA-mvpq-2v8x-ww6g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23886 · Vendor Advisory
• https://github.com/swift-otel/swift-otel/releases/tag/1.0.4 · Note
• https://github.com/swift-otel/swift-w3c-trace-context/releases/tag/1.0.0-beta.5 · Note
• https://github.com/swift-otel/swift-w3c-trace-context/commit/5da9b143ba6046734de3fa51dafea28290174e4e · Note
• https://github.com/swift-otel/swift-w3c-trace-context/security/advisories/GHSA-mvpq-2v8x-ww6g · Note
• https://github.com/swift-otel/swift-w3c-trace-context · Note
• https://twitter.com/VulmonFeeds/status/2013385745583472949 · Twitter Post
• https://twitter.com/CVEnew/status/2013359957169570013 · Twitter Post