CVE-2023-26137: High severity drogon vulnerability

Published Jul 6, 2023

Updated

All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.

Affected Software

1 affected component

Drogon Drogon

Event History

Jul 6, 2023

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-26137?

CVE-2023-26137 is considered a high severity vulnerability due to its potential for HTTP Response Splitting attacks.

How do I fix CVE-2023-26137?

To fix CVE-2023-26137, validate and sanitize all untrusted user input before using it in the addHeader and addCookie functions.

What are the potential impacts of CVE-2023-26137?

The potential impacts of CVE-2023-26137 include HTTP response splitting, which can lead to web cache poisoning and cross-site scripting attacks.

Which versions of Drogon are affected by CVE-2023-26137?

All versions of the Drogon framework are affected by CVE-2023-26137.

Is CVE-2023-26137 a known issue in the Drogon framework?

Yes, CVE-2023-26137 is a documented and recognized vulnerability in the Drogon framework.