CVE-2023-26137 Other in drogonframework/drogon
Attackers can inject malicious content into HTTP responses via header splitting in the Drogon C++ web framework library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-26137?
CVE-2023-26137 is a high-severity vulnerability in drogonframework/drogon, published on 6 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.
Which versions are affected by CVE-2023-26137?
It affects 1 product.
Products include Drogon Drogon.
How do I fix CVE-2023-26137?
No fix has been published for CVE-2023-26137 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-26137 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26137 exists.
Other vulnerabilities in drogonframework/drogon
Sources
Also known as GHSA-73h3-w2hp-q47q.