CVE-2023-26148 Other in ithewei/libhv
Attackers can inject CRLF characters into HTTP request headers via untrusted input, potentially manipulating requests or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-26148?
CVE-2023-26148 is a medium-severity vulnerability in ithewei/libhv, published on 29 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.
Which versions are affected by CVE-2023-26148?
It affects 1 product.
Products include Ithewei Libhv.
How do I fix CVE-2023-26148?
No fix has been published for CVE-2023-26148 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-26148 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26148 exists.
Other vulnerabilities in ithewei/libhv
Sources
Also known as GHSA-qfcm-r8pp-mrfm.