---
id: CVE-2026-86983
title: >-
  A remote attacker may be able to terminate a process that passes
  attacker-controlled input to the P-384 VOPRF API without bounding its length
summary: >-
  A remote attacker may be able to terminate a process that passes
  attacker-controlled input to the P-384 VOPRF API without bounding its length.
  This vulnerability is addressed in swift-crypto version 5.0.3.
severity: none
vendor: Apple
product: swift-crypto
affected:
  - swift-crypto < 5.0.3
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T23:02:44.171Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86983'
references:
  - url: >-
      https://github.com/apple/swift-crypto/security/advisories/GHSA-jwv7-rv4f-rff2
tags:
  - cve.org
epss: 0.00162
epssPercentile: 0.05442
ingestedAt: '2026-10-30T21:09:21.620Z'
---

## Overview

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.

## Affected

- `swift-crypto < 5.0.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.