CVE-2023-0040

HIGH
Published Jan 18, 20233y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Jan 18, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 2

CWE-74
CWE-93

Affected Products 4

VendorProductVersionRange
asynchttpclient_projectasync-http-client* <1.4.1
asynchttpclient_projectasync-http-client*≥1.5.0  –  <1.9.1
asynchttpclient_projectasync-http-client*≥1.10.0  –  <1.12.1
asynchttpclient_projectasync-http-client*≥1.13.0  –  <1.13.2

References 1

  • github.com https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.