GHSA-9jxr-mwpp-w643
Improper header validation in httpsoft/http-message
GHSA-9jxr-mwpp-w643 is a medium vulnerability (CVSS 5.3) in httpsoft/http-message, published April 21, 2023. No source lists public exploit code. Fixed in httpsoft/http-message 1.0.12.
- Severity
- 5.3 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.0.12httpsoft/http-message +1 more
Description
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.0.12.
Workarounds
There are no known workarounds.
References
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
httpsoft/http-messagePackagist | before 1.0.12 | 1.0.12 |
httpsoft/http-messagePackagist | before 1.0.12, plus listed versions 1.0.01.0.11.0.101.0.111.0.2 Show 7 moreShow less1.0.31.0.41.0.51.0.61.0.71.0.81.0.9 | 1.0.12 |
What each source reports
GitHub Advisories Score used
Improper header validation in httpsoft/http-message
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.0.12.
Workarounds
There are no known workarounds.
References
- Record
GHSA-9jxr-mwpp-w643- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
OSV
Improper header validation in httpsoft/http-message
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.0.12.
Workarounds
There are no known workarounds.
References
- Record
GHSA-9jxr-mwpp-w643- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-436
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.