What’s Vulnerable › Vulnerabilities

CVE-2023-26138

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-06 · updated 2026-06-17
• Weakness: CWE-93

Description

All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers in the addHeader function. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.

Affected products

• drogonframework/drogon: all versions

References

• https://gist.github.com/dellalibera/d2abd809f32ec6c61be1f41d80edf61b
• https://security.snyk.io/vuln/SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-5665555
• https://gist.github.com/dellalibera/d2abd809f32ec6c61be1f41d80edf61b
• https://security.snyk.io/vuln/SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-5665555

Get alerted when CVE-2023-26138 or the next vulnerability affects your stack