Medium severity · published Sep 12, 2023
CVE-2023-26142
All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set_header and add_header functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Crow · Crowcpp
before 1.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26142
Exploit
https://gist.github.com/dellalibera/9247769cc90ed96c0d72ddbcba88c65c
Third Party Advisory
https://security.snyk.io/vuln/SNYK-UNMANAGED-CROW-5665556
More from Crow
9.8
CVE-2022-38667
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used
9.8
CVE-2022-34970
Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h
7.5
CVE-2026-116011
Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
7.5
CVE-2022-38668
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller…
7.5
CVE-2021-23514
This affects the package Crow before 0.3+4