CVE-2023-26142

MEDIUM Year: 2023
CVSS v3 Score
6.1
Medium
Weakness Type
CWE-113
View all →

Vulnerability Description

All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set_header and add_header functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.

Related Vulnerabilities

CVE-2016-5325

MEDIUM
CVSS:6.1(Medium)

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject ...

CWE-1132016

CVE-2016-5699

MEDIUM
CVSS:6.1(Medium)

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP ...

CWE-1132016

CVE-2016-6839

MEDIUM
CVSS:6.1(Medium)

CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

CWE-1132016

CVE-2017-12308

MEDIUM
CVSS:6.1(Medium)

A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack against a user of th...

CWE-1132017

CVE-2017-1262

MEDIUM
CVSS:6.1(Medium)

IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split respon...

CWE-1132017

CVE-2017-7443

MEDIUM
CVSS:6.1(Medium)

apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0[ad] regular expression.

CWE-1132017