Response Header Injection in CrowCpp HTTP Framework by Crow
CVE-2026-38967

9.8CRITICAL

Key Information:

Vendor

CrowCpp

Status
Crow
Vendor
CVE Published:
2 June 2026

What is CVE-2026-38967?

The Crow HTTP framework, specifically versions up to 1.3.1, is susceptible to response header injection due to unvalidated input being incorporated into response headers. If exploited, this vulnerability can lead to the injection of arbitrary headers into server responses, posing risks such as Cross-Site Scripting (XSS) or HTTP Response Splitting. Developers using Crow are urged to validate or sanitize user-generated input to prevent possible security breaches.

References

https://github.com/CrowCpp/Crow/issues/1165
https://github.com/CrowCpp/Crow/pull/1167

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.