Skip to content
Sign in
5.4 Medium

CVE-2023-26138 All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to…

Description

All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers in the addHeader function. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.

Affected products and versions

Product Affected versions Fixed in
drogonframework/drogon Versions not published

Other CVEs of drogonframework/drogon

The 3 CVEs of drogonframework/drogon →
CVE-2023-26137 All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input… 7.2 High CVE-2022-25297 This affects the package drogonframework/drogon before 1.7.5 7.5 High
Track this CVE