CVE-2025-61689: HTTP.jl vulnerable to Header injection/Response splitting via header construction.
HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header injection, leading to cache poisoning, XSS, session fixation, and more. This issue is fixed in HTTP.jl v1.10.19.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61689?
CVE-2025-61689 is considered a significant vulnerability due to its potential for HTTP response splitting and header injection.
How do I fix CVE-2025-61689?
To mitigate CVE-2025-61689, upgrade HTTP.jl to version 1.10.19 or later, where the vulnerability has been addressed.
What types of applications are affected by CVE-2025-61689?
CVE-2025-61689 affects applications using versions of HTTP.jl prior to 1.10.19 in the Julia programming language.
What are the risks associated with CVE-2025-61689?
The risks of CVE-2025-61689 include exposure to CRLF injection attacks, which can lead to session hijacking and cache poisoning.
Is there a workaround for CVE-2025-61689 if I cannot upgrade?
Currently, there are no known effective workarounds for CVE-2025-61689, and upgrading is strongly recommended.