CVE-2025-61689
HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header injection, leading to cache poisoning, XSS, session fixation, and more. This issue is fixed in HTTP.jl `v1.10.19`.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
- EPSS probability
- 0.34%
- CWE
- CWE-113
- Published
- 2025-10-10
- Last modified
- 2026-03-12
Affected products
- JuliaWeb HTTP.jl
Weakness type
Related vulnerabilities
- CVE-2026-77341 — cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
- CVE-2026-39915 — TIM Flow < 26.0.6 CRLF Injection via rt Parameter
- CVE-2026-50576 — ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests
- CVE-2026-67289 — FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
- CVE-2026-66746 — Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
- CVE-2026-66753 — tiny-http 0.12.0 HTTP Response Splitting via Header Injection
- CVE-2026-63771 — Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
- CVE-2026-54163 — secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input