CVE-2023-26137

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-113CWE-444

Affected software

No affected versions have been published.

Timeline

Published
Jul 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-261384.3All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headersCVE-2023-261397.5Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() funcCVE-2023-26145.4Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-261406.1Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objeCVE-2023-261414.9Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.jsCVE-2023-261426.1All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header CVE-2023-261439.1Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sCVE-2023-261445.3Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OvCVE-2023-261458.1This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.CVE-2023-261466.1All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a maliciCVE-2023-261476.1All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers valueCVE-2023-261485.3All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An atta
CVE-2023-26137: Medium severity, CVSS 6.1 | Vulnix