CVE-2019-17513

An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.

• CWE-74

• https://github.com/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23aePatch
• https://github.com/ratpack/ratpack/commit/efb910d38a96494256f36675ef0e5061097dd77dPatch
• https://github.com/ratpack/ratpack/releases/tag/v1.7.5Release Notes, Third Party Advisory
• https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9jThird Party Advisory
• https://ratpack.io/versions/1.7.5Vendor Advisory
• https://github.com/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23aePatch
• https://github.com/ratpack/ratpack/commit/efb910d38a96494256f36675ef0e5061097dd77dPatch
• https://github.com/ratpack/ratpack/releases/tag/v1.7.5Release Notes, Third Party Advisory
• https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9jThird Party Advisory
• https://ratpack.io/versions/1.7.5Vendor Advisory

Published

Oct 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17508On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/se…9.8
• CVE-2019-17509D-Link DIR-846 devices with firmware 100A35 allow remote att…9.8
• CVE-2019-1751A vulnerability in the Network Address Translation 64 (NAT64…8.6
• CVE-2019-17510D-Link DIR-846 devices with firmware 100A35 allow remote att…9.8
• CVE-2019-17511There are some web interfaces without authentication require…7.5
• CVE-2019-17512There are some web interfaces without authentication require…9.1
• CVE-2019-17514library/glob.html in the Python 2 and 3 documentation before…7.5
• CVE-2019-17515The CleanTalk cleantalk-spam-protect plugin before 5.127.4 f…6.1
• CVE-2019-17517The Bluetooth Low Energy implementation on Dialog Semiconduc…5.7
• CVE-2019-17518The Bluetooth Low Energy implementation on Dialog Semiconduc…6.5
• CVE-2019-17519The Bluetooth Low Energy implementation on NXP SDK through 2…8.8
• CVE-2019-1752A vulnerability in the ISDN functions of Cisco IOS Software …7.5