SB20261111195 - HTTP response splitting in Excon

Description

This security bulletin contains information about 1 vulnerability.

1) HTTP response splitting (CVE-ID: N/A)

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to inject HTTP headers or additional requests, compromising request integrity.

The vulnerability exists due to improper neutralization of CR, LF, and NUL characters in Excon's request construction when processing host, method, path, query, and header values. A remote attacker can supply unsafe characters in request parameters to split headers or introduce additional requests.

Remediation

Install update from vendor's website.

References

• https://github.com/excon/excon/security/advisories/GHSA-p548-38c8-67cr
• https://github.com/excon/excon/commit/005cc84d05e7b1af00e393a42e7c47caeb892d1a