CVE-2023-26147
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 29, 2023
- Updated
- Sep 23, 2024
- Reserved
- Feb 20, 2023
Description
All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers values. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content, like for example additional headers or new response body, leading to a potential XSS vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P | snyk |
Weaknesses
- CWE-113 HTTP Response Splitting
Affected Products
| Product | Versions |
|---|---|
ithewei/libhvn/a |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.