What’s Vulnerable › Vulnerabilities

CVE-2023-41834: Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-19 · updated 2026-06-17
• Weakness: CWE-74

Description

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. Users should upgrade to Apache Flink Stateful Functions version 3.3.0.

Affected products

• Apache Software Foundation Apache Flink Stateful Functions: from 3.1.0 through 3.2.0

References

• http://www.openwall.com/lists/oss-security/2023/09/19/3
• https://lists.apache.org/thread/cvxcsdyjqc3lysj1tz7s06zwm36zvwrm
• http://www.openwall.com/lists/oss-security/2023/09/19/3
• https://lists.apache.org/thread/cvxcsdyjqc3lysj1tz7s06zwm36zvwrm

Get alerted when CVE-2023-41834 or the next vulnerability affects your stack