Riskcovery

CVE-2023-41834

Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences

State
Published
Severity
Not scored
Published
Sep 19, 2023
Updated
Feb 13, 2025
Reserved
Sep 1, 2023

Read the record on cve.org

Description

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser.

Users should upgrade to Apache Flink Stateful Functions version 3.3.0.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

ProductVersions
Apache Flink Stateful FunctionsApache Software Foundation
  • 3.1.0 through 3.2.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.