HTTP Response Splitting Vulnerability in Crow Package by Unmanaged Vendor

CVE-2023-26142

What is CVE-2023-26142?

The Crow package exposes a significant vulnerability where all versions fail to properly sanitize header values against CRLF (carriage return line feed) injection. This weakness allows an attacker to exploit untrusted user input by manipulating header values in the set_header and add_header functions. By appending characters, an attacker can influence the HTTP response headers, potentially injecting malicious content or redirecting users to unauthorized locations, compromising the security of web applications utilizing this package.

References