CVE-2025-61689CWE-113

CVE-2025-61689

published October 10, 2025

CVSS
8.7
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header injection, leading to cache poisoning, XSS, session fixation, and more. This issue is fixed in HTTP.jl `v1.10.19`.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.4th percentile
Weakness
CWE-113 · Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Published
2025-10-10T21:15Z
References (2)
https://github.com/JuliaWeb/HTTP.jl/releases/tag/v1.10.19 · [email protected]https://github.com/JuliaWeb/HTTP.jl/security/advisories/GHSA-h3x8-ppwj-6vcj · [email protected]
EPSS history
Timeline
  • 10 OCT 16:48Z
    HTTP.jl vulnerable to Header injection/Response splitting via header construction.
    cvelistv5