ALPINE-CVE-2023-30589

See a problem?
Please try reporting it to the source first.
Source
https://security.alpinelinux.org/vuln/CVE-2023-30589
Import Source
https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-30589.json
JSON Data
https://api.osv.dev/v1/vulns/ALPINE-CVE-2023-30589
Upstream
Published
2023-07-01T00:15:10Z
Modified
2026-11-03T06:32:48Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

References

Affected packages

Alpine:v3.16
openjdk17

Package

Name
openjdk17
Purl
pkg:apk/alpine/openjdk17?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.0.9_p8-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-30589.json"
Alpine:v3.17
openjdk17

Package

Name
openjdk17
Purl
pkg:apk/alpine/openjdk17?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.0.9_p8-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-30589.json"
Alpine:v3.18
openjdk17

Package

Name
openjdk17
Purl
pkg:apk/alpine/openjdk17?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.0.9_p8-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-30589.json"
Alpine:v3.19
openjdk17

Package

Name
openjdk17
Purl
pkg:apk/alpine/openjdk17?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.0.9_p8-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-30589.json"
Alpine:v3.20
openjdk17

Package

Name
openjdk17
Purl
pkg:apk/alpine/openjdk17?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.0.9_p8-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-30589.json"
Alpine:v3.21
openjdk17

Package

Name
openjdk17
Purl
pkg:apk/alpine/openjdk17?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.0.9_p8-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-30589.json"
Alpine:v3.22
openjdk17

Package

Name
openjdk17
Purl
pkg:apk/alpine/openjdk17?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.0.9_p8-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-30589.json"
Alpine:v3.23
openjdk17

Package

Name
openjdk17
Purl
pkg:apk/alpine/openjdk17?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.0.9_p8-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-30589.json"
Alpine:v3.24
openjdk17

Package

Name
openjdk17
Purl
pkg:apk/alpine/openjdk17?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.0.9_p8-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-30589.json"