{"id":"CVE-2022-35507","aliases":["EUVD-2022-38395","GHSA-xfgp-gpjw-wmqr"],"status":"published","title":"A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and...","description":"A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01519,"percentile":0.74751,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74"],"published":"2022-12-04T00:00:00Z","modified":"2026-06-17T04:51:54Z","exploits":[{"source":"nuclei","id":"CVE-2022-35507","title":"Proxmox - CRLF Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-35507.yaml"}],"products":[{"vendor":"proxmox","product":"proxmox_mail_gateway"},{"vendor":"proxmox","product":"pve_http_server"},{"vendor":"proxmox","product":"virtual_environment"}],"references":[{"url":"https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=936007ae0241811093155000486da171379c23c2","tags":["x_transferred"]},{"url":"https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/","tags":["x_transferred","Exploit","Patch","Technical Description","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35507"},{"url":"https://git.proxmox.com/?p=pve-http-server.git;a=commitdiff;h=936007ae0241811093155000486da171379c23c2"},{"url":"https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway"},{"url":"https://github.com/advisories/GHSA-xfgp-gpjw-wmqr"}],"sources":{"cve":[{"id":"CVE-2022-35507","description":"A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.","status":"published","published":"2022-12-04T00:00:00Z","modified":"2025-04-24T15:23:02.45Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-38395","description":"A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.","status":"published","published":"2022-12-04T00:00:00Z","modified":"2025-04-24T15:23:02Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:04.118749Z"}],"ghsa":[{"id":"GHSA-xfgp-gpjw-wmqr","title":"A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and...","description":"A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.","status":"published","published":"2022-12-04T21:30:25Z","modified":"2025-04-24T18:32:05Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:02:01.717603Z"}],"nvd":[{"id":"CVE-2022-35507","description":"A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.","status":"published","published":"2022-12-04T19:15:09.85Z","modified":"2026-06-17T04:51:54.04Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:07:33.239526Z"}]}}