CVE-2008-3906
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject...
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
Exploit likelihood
What each source reports
NVD Score used
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
- Record
CVE-2008-3906- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
- Record
CVE-2008-3906- Updated
- 2026-11-02
EUVDEUVD-2008-3892 No score
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
- Record
EUVD-2008-3892- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fwxc-72gp-54jq No score
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject...
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
- Record
GHSA-fwxc-72gp-54jq- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
- Record
CVE-2008-3906- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-3906 No score
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
- Record
DEBIAN-CVE-2008-3906- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Mono 2.0 - 'System.Web' HTTP Header Injection | 2008-08-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3906 is a medium vulnerability (CVSS 4.3) in Mono, published September 4, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.10%, the 94th percentile. Fixed in mono 1.9.1+dfsg-4.
References
securityfocus.com/bid/30867
exchange.xforce.ibmcloud.com/vulnerabilities/44740
secunia.com/advisories/36494
openwall.com/lists/oss-security/2008/08/27/6
vupen.com/english/advisories/2008/2443
Show 8 moreShow less
wiki.rpath.com/wiki/Advisories:rPSA-2008-0286
bugzilla.novell.com/show_bug.cgi?id=418620
usn.ubuntu.com/826-1
mandriva.com/security/advisories?name=MDVSA-2008:210
nvd.nist.gov/vuln/detail/CVE-2008-3906
github.com/advisories/GHSA-fwxc-72gp-54jq
security-tracker.debian.org/tracker/CVE-2008-3906