CVE-2019-16771 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria

What is CVE-2019-16771?

CVE-2019-16771 is a medium-severity vulnerability in LINE Armeria, published on 6 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement, cache poisoning, Cross-site scripting (XSS), and page hijacking.

Weakness: CWE-74, CWE-113

Which versions are affected by CVE-2019-16771?

4 open source packages ship an affected version, including com.linecorp.armeria:armeria. It affects 1 product.

Products include Linecorp Armeria.

How do I fix CVE-2019-16771?

Upgrade com.linecorp.armeria:armeria to 0.97.0 or later.

Is CVE-2019-16771 being exploited?

There is no known exploitation of CVE-2019-16771 in the wild and no public exploit code.

Other vulnerabilities in LINE Armeria

• CVE-2024-1735 Armeria SAML authentication bypass due to missing validation on unsigned SAML messages Critical 9.1
• CVE-2023-38493 Paths contain matrix variables bypass decorators High 7.5
• CVE-2021-43795 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-24r8-fm9r-cpj2, GHSA-35fr-h7jr-hh86.