Swift Crypto 5.0.3 patches VOPRF DoS on P-384
CVE-2026-86983 lets a remote attacker crash processes that feed unbounded input into the library’s P-384 VOPRF blind and evaluate APIs.
Swift Crypto 5.0.3 fixes a denial-of-service flaw in its verifiable oblivious pseudorandom function (VOPRF) support for the P-384 curve. Users of versions from 3.10.0 through 5.0.2 are urged to upgrade as soon as practical.
CVE-2026-86983 covers blind and evaluate APIs that failed to enforce the input length limit defined in RFC 9497. A remote attacker who can supply attacker-controlled input to those APIs without a length bound may terminate the process.
The issue was reported by Karan Kurani. The maintainers published the fix in the 5.0.3 release and documented it in the project’s GitHub security advisory.