{"schema":"threatline.record/2","record":{"id":"CVE-2026-86983","aliases":["GHSA-jwv7-rv4f-rff2"],"summary":"A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5","details":"A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.","categories":["Unclassified"],"product":"swift-crypto","vendor":"Apple","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-86983","source_modified_at":"2026-10-28T23:02:44.171Z","fetched_at":"2026-10-29T00:48:09.584895Z","product":"swift-crypto","vendor":"Apple","versions":[{"version":"0","status":"affected","lessThan":"5.0.3","versionType":"custom"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/apple/swift-crypto/security/advisories/GHSA-jwv7-rv4f-rff2","source_modified_at":"2026-10-20T09:05:09Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"swift","name":"swift-crypto"},"range":">= 3.10.0, <= 5.0.2"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-86983","source_modified_at":"2026-10-28T23:02:44.171Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"name":"swift-crypto","ecosystem":null},"version":"5.0.3","basis":"first unaffected version stated in the CVE record"},{"source":"GitHub Advisory Database","source_url":"https://github.com/apple/swift-crypto/security/advisories/GHSA-jwv7-rv4f-rff2","source_modified_at":"2026-10-20T09:05:09Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"swift","name":"swift-crypto"},"version":"5.0.3"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T23:01:59.598Z","modified_at":"2026-10-28T23:02:44.171Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-86983","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-28T23:02:44.171Z"},{"source":"GitHub Advisory Database","url":"https://github.com/apple/swift-crypto/security/advisories/GHSA-jwv7-rv4f-rff2","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-20T09:05:09Z"}],"sources":["CVE List","GitHub Advisory Database"],"references":[{"source":"CVE List","url":"https://github.com/apple/swift-crypto/security/advisories/GHSA-jwv7-rv4f-rff2"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T23:02:44.171Z","content_hash":"3971b9e63eb738a7cc661f5c6ed9e72c3fb35ee81a5bbba86478a8278fe0944b"}}