CVE-2026-24489 Gakido vulnerable to HTTP Header Injection (CRLF Injection)
Attackers can inject arbitrary HTTP headers via CRLF sequences in user-supplied values, potentially bypassing security controls or modifying requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24489?
CVE-2026-24489 is a medium-severity vulnerability in HappyHackingSpace gakido, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allowed HTTP header injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names. When making HTTP requests with user-controlled header values containing `\r\n` (CRLF), `\n` (LF), or `\x00` (null byte) characters, an attacker could inject arbitrary HTTP headers into the request. The fix in version 0.1.1 adds a `_sanitize_header()` function that strips `\r`, `\n`, and `\x00` characters from both header names and values before they are included in HTTP requests.
Which versions are affected by CVE-2026-24489?
3 open source packages ship an affected version, including gakido.
| Package | Affected | Fixed in |
|---|---|---|
gakido PyPI | All versions | 0.1.1 |
gakido PyPI | All versions | 0.1.1 |
gakido PyPI | All versions | 0.1.1 |
How do I fix CVE-2026-24489?
Upgrade gakido to 0.1.1 or later.
Is CVE-2026-24489 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24489 exists.
Sources
Also known as GHSA-gcgx-chcp-hxp9, PYSEC-2026-1400.