CVE-2023-26147

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers values. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content, like for example additional headers or new response body, leading to a potential XSS vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-113CWE-79

Affected software

VendorProductVersions
n/aithewei/libhv< *

References

Timeline

Published
Sep 29, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-261485.3All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attaCVE-2023-261496.1Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, viaCVE-2023-26155.4Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-261507.5Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space witCVE-2023-261517.5Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet anCVE-2023-261527.5All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath CVE-2023-261539.8Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_CVE-2023-261545.9Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alCVE-2023-261559.8All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize CVE-2023-261567.5Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary sCVE-2023-261577.5Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving sectionCVE-2023-261588.2All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute
CVE-2023-26147: Medium severity, CVSS 6.1 | Vulnix