CVE-2007-2404

no score yetEPSS 1.4%

CRLF injection vulnerability in CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 before 20070731 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in an unspecified context. NOTE: this can be leveraged for cross-site scripting (XSS) attacks.

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
Published: 2007-08-03
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

apple:mac_os_x
apple:mac_os_x_server

References

http://docs.info.apple.com/article.html?artnum=306172
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://secunia.com/advisories/26235
http://securitytracker.com/id?1018491
http://www.securityfocus.com/bid/25159

Check your stack JSON