REDHAT-BUG-1823527: CRLF Injection
A CRLF injection flaw was found in the Lightweight HTTP Server component of OpenJDK. The HttpServer implementation did not restrict the use of CR and LF characters in values for HTTP headers, possibly allowing HTTP response splitting attacks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
Applications using the OpenJDK Lightweight HTTP Server HttpServer implementation are in scope, particularly where externally influenced data can be placed into HTTP response header values.
What attacker-controlled condition is needed for exploitation?
An attacker would need to cause carriage return or line feed characters to be included in a value used for an HTTP response header. The affected implementation did not restrict those characters.
How can teams assess whether their application is affected?
Review applications that use the OpenJDK Lightweight HTTP Server and identify code paths that construct response headers. Determine whether header values can include untrusted input containing CR or LF characters.