{"id":"CVE-2023-52354","aliases":["DEBIAN-CVE-2023-52354","EUVD-2024-0351","GHSA-g4x3-mfpj-f335","GO-2024-2478","UBUNTU-CVE-2023-52354"],"status":"published","title":"chasquid HTTP Request/Response Smuggling vulnerability","description":"chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00468,"percentile":0.40982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2024-01-22T00:00:00Z","modified":"2026-10-26T18:02:59Z","fixes":[{"ecosystem":"Go","package":"github.com/albertito/chasquid","fixed_in":["1.13"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"chasquid","fixed_in":["1.13-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"chasquid","fixed_in":["1.13-1"],"sources":["osv"]},{"ecosystem":"Go","package":"blitiri.com.ar/go/chasquid","fixed_in":["1.13.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/albertito/chasquid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"chasquid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11-2","1.12-1","1.13-1","1.14.0-2","1.15.0-1","1.16.0-1","1.16.0-2","1.18.0-1","1.19.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"chasquid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"chasquid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/albertito/chasquid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13"}]}]},{"source":"osv","ecosystem":"Go","package":"blitiri.com.ar/go/chasquid","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"chasquid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.03+git20170716.6867859-1","0.04-1","0.04-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"chasquid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.00-1","1.1-1","1.2-1","1.2-1ubuntu0.1","1.2-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"chasquid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-1","1.8-1","1.8-1ubuntu0.1","1.8-1ubuntu0.2","1.8-1ubuntu0.3","1.8-1ubuntu0.3+esm1","1.8-1ubuntu0.3+esm2"]}],"products":[{"vendor":"blitiri","product":"chasquid"}],"references":[{"url":"https://blitiri.com.ar/p/chasquid/relnotes/#113-2023-12-24","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52354","tags":["advisory"]},{"url":"https://github.com/albertito/chasquid/issues/47","tags":["web","report"]},{"url":"https://github.com/albertito/chasquid/commit/a996106eeebe81a292ecba838c7503cac7493e74","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-g4x3-mfpj-f335","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-52354","tags":["advisory"]},{"url":"https://github.com/albertito/chasquid","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-52354","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52354","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-52354","description":"chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.","status":"published","published":"2024-01-22T00:00:00Z","modified":"2025-06-17T15:12:50.193Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:35:18.508816Z"}],"euvd":[{"id":"EUVD-2024-0351","description":"chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.","status":"published","published":"2024-01-22T00:00:00Z","modified":"2025-06-17T15:12:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:22.732364Z"}],"ghsa":[{"id":"GHSA-g4x3-mfpj-f335","title":"chasquid HTTP Request/Response Smuggling vulnerability","description":"chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.","status":"published","published":"2024-01-22T06:30:32Z","modified":"2024-01-29T22:29:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:37:33.019154Z"}],"nvd":[{"id":"CVE-2023-52354","description":"chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.","status":"published","published":"2024-01-22T06:15:07.78Z","modified":"2026-06-17T06:42:33.14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:09:01.900189Z"}],"osv":[{"id":"CVE-2023-52354","description":"chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.","status":"published","published":"2024-01-22T06:15:07.78Z","modified":"2026-03-14T12:23:06.820563Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DEBIAN-CVE-2023-52354","description":"chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.","status":"published","published":"2024-01-22T06:15:07.78Z","modified":"2026-10-26T18:02:59.078807711Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"GHSA-g4x3-mfpj-f335","title":"chasquid HTTP Request/Response Smuggling vulnerability","description":"chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.","status":"published","published":"2024-01-22T06:30:32Z","modified":"2026-09-10T03:50:00.231931079Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"UBUNTU-CVE-2023-52354","description":"chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.","status":"published","published":"2024-01-22T06:15:00Z","modified":"2026-03-25T18:57:37.247373Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"GO-2024-2478","title":"chasquid HTTP Request/Response Smuggling vulnerability in github.com/albertito/chasquid in blitiri.com.ar/go/chasquid","description":"chasquid HTTP Request/Response Smuggling vulnerability in github.com/albertito/chasquid in blitiri.com.ar/go/chasquid","status":"published","published":"2024-06-28T15:28:53Z","modified":"2026-03-03T04:54:30.946515Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}