[GHSA-q3g2-m552-3r9c] swift-nio-http2: Missing CR/LF/NUL validation in header values

[identity-wael]

Updates

• Affected products
• CVSS v3

Comments
Correct the Swift package identifier from swift-nio-http2 to github.com/apple/swift-nio-http2.

The advisory's source repository and both referenced fix commits identify apple/swift-nio-http2. The existing reviewed advisory GHSA-4px2-pw77-vc85 uses github.com/apple/swift-nio-http2 for the same Swift package: GHSA-4px2-pw77-vc85

The database documents Swift packages as namespaced by DNS: https://github.com/github/advisory-database#supported-ecosystems

Using the same repository-qualified identifier makes this record consistent with the other advisories for this package. This suggestion changes only the package identifier; the affected range (< 1.45.0), patched version (1.45.0), description, and severity are unchanged.

[github]

Hi there @glbrntt! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[identity-wael]

Review note: the advisory improvement form also removed the existing CVSS v3 entry, although I changed only the package name and reason fields. That removal is unintended. Please preserve CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N alongside the existing CVSS v4 entry when applying the package-name correction. I cannot directly edit the generated branch to restore it.