CVE-2023-26142

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-26142

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26142.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-26142

Published

2023-09-12T05:00:01Z

Modified

2026-08-12T03:51:19Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P CVSS Calculator

Summary

[none]

Details

All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set_header and add_header functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.

Database specific

{
    "cna_assigner": "snyk",
    "cwe_ids": [
        "CWE-113"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26142.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "*"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/crowcpp/crow

Affected ranges

Type

GIT

Repo

https://github.com/crowcpp/crow

Events

Introduced

edf12f699ec3bf6f751cf73cb97f32919e48ca6e

Last Affected

edf12f699ec3bf6f751cf73cb97f32919e48ca6e

Database specific

Show details

{
    "cpe": "cpe:2.3:a:crowcpp:crow:1.0\\+5:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0+5"
        },
        {
            "last_affected": "1.0+5"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

1.*

1.0+5

v0.*

v0.1+5

v1.*

v1.0+5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26142.json"