CVE-2016-5331

6.1 mediumEPSS 1.9%

CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-93
Published: 2016-08-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

vmware:esxi
vmware:vcenter_server

References

http://packetstormsecurity.com/files/138211/VMware-vSphere-Hypervisor-ESXi-HTTP-Response-Injection.html
http://seclists.org/fulldisclosure/2016/Aug/38
http://www.securityfocus.com/archive/1/539128/100/0/threaded
http://www.securityfocus.com/bid/92324
http://www.securitytracker.com/id/1036543

Check your stack JSON