CVE-2023-26138 Other in drogonframework/drogon
Attackers can inject CRLF characters into HTTP headers via the addHeader function, potentially manipulating request structure or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-26138?
CVE-2023-26138 is a medium-severity vulnerability in drogonframework/drogon, published on 6 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers in the addHeader function. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.
Which versions are affected by CVE-2023-26138?
It affects 1 product.
Products include Drogon Drogon.
How do I fix CVE-2023-26138?
No fix has been published for CVE-2023-26138 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-26138 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26138 exists.
Other vulnerabilities in drogonframework/drogon
Sources
Also known as GHSA-3jvv-m32r-4hpf.