SwiftNIO SSH patches unauthenticated stack write (CVE-2026-43798)

SwiftNIO SSH users should move to 0.14.1 immediately. That release closes CVE-2026-43798, an unauthenticated out-of-bounds stack write triggered by oversized ECDSA signature integers.

The library copied incoming ECDSA signature values without checking their length, so an attacker could overwrite stack memory before cryptographic verification ran. The flaw depends on the signature type in the attacker’s message, not on which algorithms the server accepts, so algorithm restrictions do not mitigate it.

Security researcher Yanchon918s reported the issue. Maintainers advised upgrading as soon as possible.