CVE-2023-26147

Katalog CVE

CVSS 6.1 · Medium EPSS 0,44%

Kerentanan Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') pada ithewei libhv. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers values. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content, like for example additional headers or new response body, leading to a potential XSS vulnerability.

Rincian

Terbit di NVD

29 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/dellalibera/2be265b56b7b3b00de1a777b9dec0c7b exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730768 advisory pihak ketiga