TL;DR: Users of SwiftNIO SSH should update to 0.14.1 as soon as possible.
SwiftNIO SSH has a security vulnerability where an unauthenticated attacker can write data out of bounds on the stack. This happens because the system does not check the length of incoming ECDSA signature integers before copying them, allowing oversized values to overwrite memory prior to cryptographic verification.
This attack is based on the signature type in an attacker's message, not on the configuration of any specific accepted algorithm. Algorithm restrictions do not help. You can read the full security advisory on GitHub.
This vulnerability was reported by security researcher @Yanchon918s.
