HTTP response splitting in FortiProxy and FortiOS - CVE-2025-62675
Published: July 14, 2026
Vulnerability identifier: #VU137529
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-62675
CWE-ID: CWE-113
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper neutralization of crlf sequences in http headers ('http response splitting') in Web Filter warning page. An attacker in possession of a valid web filter override token can inject arbitrary headers via tricking a user into clicking on a crafted link.
Affected software
FortiProxy
FortiOS
FortiOS
How to mitigate CVE-2025-62675
Install update from vendor's website.
FortiProxy - update to 7.6.5
FortiOS - update to 7.6.5
FortiOS - update to 7.6.5