CVE-2023-41834CWE-113CWE-74

Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences

published September 19, 2023

CVSS
—
EPSS
2%
Percentile
83.1
In the wild
Unconfirmed
What it is

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser.

Users should upgrade to Apache Flink Stateful Functions version 3.3.0.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02293 · 83.1th percentile
Weaknesses
CWE-113 · Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'); CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2023-09-19T12:34Z
EPSS history
Timeline
  • 19 SEP 12:34Z
    Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences
    cvelistv5