All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.
References
| Link | Resource |
|---|---|
| https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730769 | Third Party Advisory |
| https://gist.github.com/dellalibera/65d136066fdd5ea4dddaadaa9b0ba90e | Exploit Third Party Advisory |
Configurations
History
07 Nov 2023, 04:09
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-29 05:15
Updated : 2023-11-07 04:09
NVD link : CVE-2023-26148
Mitre link : CVE-2023-26148
JSON object : View
Products Affected
ithewei
- libhv
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')