CVE-2016-1133

NONE EPSS 70.3%
Published Jan 16, 201610y ago · Modified Jun 17, 20262w ago
Find Similar
Published Jan 16, 2016 10y ago
Last Modified Jun 17, 2026 2w ago

Description

CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI.

Threat Intelligence

EPSS Exploit Probability
70.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Affected Products 2

VendorProductVersionRange
denah2o* ≤1.6.1
denah2o1.7.0any

References 5

  • jvn.jp http://jvn.jp/en/jp/JVN45928828/index.html
    Vendor Advisory
  • jvndb.jvn.jp http://jvndb.jvn.jp/jvndb/JVNDB-2016-000003
    Vendor Advisory
  • github.com https://github.com/h2o/h2o/issues/682
  • github.com https://github.com/h2o/h2o/issues/684
  • h2o.examp1e.net https://h2o.examp1e.net/vulnerabilities.html#CVE-2016-1133

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.