GHSA-9jxr-mwpp-w643 Improper header validation in httpsoft/http-message
An attacker can inject newlines into HTTP headers due to improper parsing, potentially bypassing security controls in applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-9jxr-mwpp-w643?
GHSA-9jxr-mwpp-w643 is a vulnerability in httpsoft/http-message, published on 21 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.0.12.
Workarounds
There are no known workarounds.
References
Which versions are affected by GHSA-9jxr-mwpp-w643?
2 open source packages ship an affected version, including httpsoft/http-message.
| Package | Affected | Fixed in |
|---|---|---|
httpsoft/http-message Packagist | All versions | 1.0.12 |
httpsoft/http-message Packagist | All versions | 1.0.12 |
How do I fix GHSA-9jxr-mwpp-w643?
Upgrade httpsoft/http-message to 1.0.12 or later.
Is GHSA-9jxr-mwpp-w643 being exploited?
There is no known exploitation of GHSA-9jxr-mwpp-w643 in the wild and no public exploit code.