CVE-2023-26142

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set_header and add_header functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-113CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Sep 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-261439.1Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sCVE-2023-261445.3Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OvCVE-2023-261458.1This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.CVE-2023-261466.1All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a maliciCVE-2023-261476.1All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers valueCVE-2023-261485.3All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attaCVE-2023-261496.1Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, viaCVE-2023-26155.4Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-261507.5Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space witCVE-2023-261517.5Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet anCVE-2023-261527.5All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath CVE-2023-261539.8Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_