What’s Vulnerable › Vulnerabilities

CVE-2020-6858

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-03-12 · updated 2026-06-17
• Weakness: CWE-74

Description

Hotels Styx through 1.0.0.beta8 allows HTTP response splitting due to CRLF Injection. This is exploitable if untrusted user input can appear in a response header.

Affected products

• Hotels Styx: through 0.7.10; 1.0.0-beta1, 1.0.0-beta2, 1.0.0-beta3, 1.0.0-beta4, 1.0.0-beta5, 1.0.0-beta6 (+2)

References

• https://github.com/HotelsDotCom/styx/security/advisories/GHSA-6v7p-v754-j89v
• https://twitter.com/JLLeitschuh
• https://github.com/HotelsDotCom/styx/security/advisories/GHSA-6v7p-v754-j89v
• https://twitter.com/JLLeitschuh

Get alerted when CVE-2020-6858 or the next vulnerability affects your stack