CVE-2023-0040

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-0040
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0040.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-0040
Aliases
Related
Published
2023-01-18T19:15:11.163Z
Modified
2026-04-10T04:53:47.798696Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.

References

Affected packages

Git / github.com/asynchttpclient/async-http-client

Affected ranges

Type
GIT
Repo
https://github.com/asynchttpclient/async-http-client
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5ce359e6731f68cbb07196b89804005de317cc4c
Introduced
b52a8de5d6a862b5d1652d62f87ce774cbcff156
Fixed
71290d5a389800265e31022fefbb0b47ab48272a
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.4.1"
        },
        {
            "introduced": "1.5.0"
        },
        {
            "fixed": "1.9.1"
        }
    ]
}

Affected versions

async-http-client-1.*
async-http-client-1.0.0
async-http-client-1.2.0
async-http-client-1.3.0
async-http-client-1.3.1
async-http-client-1.3.2
async-http-client-1.4.0
async-http-client-1.5.0
async-http-client-1.6.0
async-http-client-1.6.1
async-http-client-1.6.2
async-http-client-1.6.3
async-http-client-1.7.0
async-http-client-1.7.1
async-http-client-1.7.10
async-http-client-1.7.11
async-http-client-1.7.12
async-http-client-1.7.13
async-http-client-1.7.14
async-http-client-1.7.15
async-http-client-1.7.16
async-http-client-1.7.17
async-http-client-1.7.18
async-http-client-1.7.19
async-http-client-1.7.2
async-http-client-1.7.20
async-http-client-1.7.21
async-http-client-1.7.22
async-http-client-1.7.23
async-http-client-1.7.24
async-http-client-1.7.3
async-http-client-1.7.4
async-http-client-1.7.5
async-http-client-1.7.6
async-http-client-1.7.7
async-http-client-1.7.8
async-http-client-1.7.9
async-http-client-1.8.0
async-http-client-1.8.1
async-http-client-1.8.10
async-http-client-1.8.11
async-http-client-1.8.12
async-http-client-1.8.2
async-http-client-1.8.3
async-http-client-1.8.4
async-http-client-1.8.5
async-http-client-1.8.6
async-http-client-1.8.7
async-http-client-1.8.8
async-http-client-1.8.9
async-http-client-1.9.0
async-http-client-1.9.0-BETA1
async-http-client-1.9.0-BETA10
async-http-client-1.9.0-BETA11
async-http-client-1.9.0-BETA12
async-http-client-1.9.0-BETA13
async-http-client-1.9.0-BETA14
async-http-client-1.9.0-BETA15
async-http-client-1.9.0-BETA16
async-http-client-1.9.0-BETA17
async-http-client-1.9.0-BETA18
async-http-client-1.9.0-BETA19
async-http-client-1.9.0-BETA2
async-http-client-1.9.0-BETA20
async-http-client-1.9.0-BETA21
async-http-client-1.9.0-BETA22
async-http-client-1.9.0-BETA23
async-http-client-1.9.0-BETA24
async-http-client-1.9.0-BETA3
async-http-client-1.9.0-BETA4
async-http-client-1.9.0-BETA5
async-http-client-1.9.0-BETA6
async-http-client-1.9.0-BETA7
async-http-client-1.9.0-BETA8
async-http-client-1.9.0-BETA9

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "1.10.0"
            },
            {
                "fixed": "1.12.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "1.13.0"
            },
            {
                "fixed": "1.13.2"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0040.json"