CVE-2023-26147 Cross-site scripting in ithewei/libhv
Attackers can inject malicious content via HTTP response splitting in libhv, potentially leading to cross-site scripting attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-26147?
CVE-2023-26147 is a medium-severity cross-site scripting vulnerability in ithewei/libhv, published on 29 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers values. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content, like for example additional headers or new response body, leading to a potential XSS vulnerability.
Which versions are affected by CVE-2023-26147?
It affects 1 product.
Products include Ithewei Libhv.
How do I fix CVE-2023-26147?
No fix has been published for CVE-2023-26147 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-26147 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26147 exists.
Other vulnerabilities in ithewei/libhv
Sources
Also known as GHSA-fh2j-2j24-wjwp.