CVE-2022-35507

A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.

• CWE-74
• CWE-74

• https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=936007ae0241811093155000486da171379c23c2
• https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/Exploit, Patch, Technical Description, Third Party Advisory
• https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=936007ae0241811093155000486da171379c23c2
• https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/Exploit, Patch, Technical Description, Third Party Advisory

Published

Dec 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3550A vulnerability classified as critical was found in X.org Se…8.8
• CVE-2022-35500Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XS…5.4
• CVE-2022-35501Stored Cross-site Scripting (XSS) exists in the Amasty Blog …5.4
• CVE-2022-35503Improper verification of a user input in Open Source MANO v7…7.5
• CVE-2022-35505A segmentation fault in TripleCross v0.1.0 occurs when sendi…7.5
• CVE-2022-35506TripleCross v0.1.0 was discovered to contain a stack overflo…7.5
• CVE-2022-35508Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (…9.8
• CVE-2022-35509An issue was discovered in EyouCMS 1.5.8. There is a Storage…5.4
• CVE-2022-3551A vulnerability, which was classified as problematic, has be…6.5
• CVE-2022-35513The Blink1Control2 application <= 2.2.7 uses weak password e…7.5
• CVE-2022-35516DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote…9.8
• CVE-2022-35517WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi…8.8