What’s Vulnerable › Vulnerabilities

CVE-2023-26148

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-09-29 · updated 2026-06-17
• Weakness: CWE-93

Description

All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.

Affected products

• ithewei/libhv: all versions

References

• https://gist.github.com/dellalibera/65d136066fdd5ea4dddaadaa9b0ba90e
• https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730769
• https://gist.github.com/dellalibera/65d136066fdd5ea4dddaadaa9b0ba90e
• https://security.snyk.io/vuln/SNYK-UNMANAGED-ITHEWEILIBHV-5730769

Get alerted when CVE-2023-26148 or the next vulnerability affects your stack