{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53094 exists.","fix":"No fix has been published for CVE-2025-53094 yet. Limit exposure of the affected software until one is available.","what":"CVE-2025-53094 is a high-severity vulnerability in ESP32Async ESPAsyncWebServer, published on 27 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-53094 and fix it if it is affected.\n\nWhat it is: CVE-2025-53094 is a high-severity vulnerability in ESP32Async ESPAsyncWebServer, published on 27 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53094 exists.\n\nAffected product: ESP32Async ESPAsyncWebServer. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-53094/ (Markdown: https://insights.sbomify.com/CVE-2025-53094/index.md)","id":"CVE-2025-53094","markdown":"https://insights.sbomify.com/CVE-2025-53094/index.md","name":"CVE-2025-53094","record":{"aliases":["GHSA-87j8-6f7g-h8wh"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_modify","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"ESP32 HTTP server library","requires_auth":"none","summary":"Attackers can inject CRLF characters into HTTP headers to manipulate responses, affecting ESPAsyncWebServer users.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-93","name":"Improper Neutralization of CRLF Sequences"},{"id":"CWE-113","name":"Improper Neutralization of CRLF Sequences in HTTP Headers"}],"description":"ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Carriage Return Line Feed) injection vulnerability exists in the construction and output of HTTP headers within `AsyncWebHeader.cpp`. Unsanitized input allows attackers to inject CR (`\\r`) or LF (`\\n`) characters into header names or values, leading to arbitrary header or response manipulation. Manipulation of HTTP headers and responses can enable a wide range of attacks, making the severity of this vulnerability high. A fix is available at pull request 211 and is expected to be part of version 3.7.9.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cpp","id":"CVE-2025-53094","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"other","year":"2025"},"n_packages":0,"n_references":3,"next":{"headline":"Sunshine application-wide CSRF in the UI leads to command injection as Administrator","id":"CVE-2025-53095"},"packages":[],"prev":{"headline":"TabberNeue vulnerable to Stored XSS through wikitext","id":"CVE-2025-53093"},"products":["ESPAsyncWebServer"],"published":"2025-06-27","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-06-27","vendors":["ESP32Async"]},"summary":"Attackers can inject CRLF characters into HTTP headers to manipulate responses, affecting ESPAsyncWebServer users.","url":"https://insights.sbomify.com/CVE-2025-53094/"}