HTTP response splitting in Excon - #VU165862
Published: November 11, 2026
Vulnerability identifier: #VU165862
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-113
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject HTTP headers or additional requests, compromising request integrity.
The vulnerability exists due to improper neutralization of CR, LF, and NUL characters in Excon's request construction when processing host, method, path, query, and header values. A remote attacker can supply unsafe characters in request parameters to split headers or introduce additional requests.
Affected software
Excon
Remediation
Install security update from vendor's website.
Excon - update to 1.12.0