CVE-2023-26142

All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set_header and add_header functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.

CVSS 3.1

6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-28)

CWEs

CWE-74, CWE-113

Published

2023-09-12

Modified

2026-10-29

Record from

the NVD, synced 2026-10-29

Affected

• crowcpp:crow

References

• https://gist.github.com/dellalibera/9247769cc90ed96c0d72ddbcba88c65c
• https://security.snyk.io/vuln/SNYK-UNMANAGED-CROW-5665556
• https://gist.github.com/dellalibera/9247769cc90ed96c0d72ddbcba88c65c
• https://security.snyk.io/vuln/SNYK-UNMANAGED-CROW-5665556

Check your stackJSON