Skip to content
Sign in
7.2 High

CVE-2023-26137 All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input…

Description

All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.

Affected products and versions

Product Affected versions Fixed in
drogonframework/drogon Versions not published

Other CVEs of drogonframework/drogon

The 3 CVEs of drogonframework/drogon →
CVE-2023-26138 All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to… 5.4 Medium CVE-2022-25297 This affects the package drogonframework/drogon before 1.7.5 7.5 High
Track this CVE