CVE-2023-26148

Katalog CVE

CVSS 5.3 · Medium EPSS 0,44%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada ithewei libhv. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.

Rincian

Terbit di NVD

29 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/dellalibera/65d136066fdd5ea4dddaadaa9b0ba90e exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730769 advisory pihak ketiga