CVE-2023-26142

All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set_header and add_header functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.

• CWE-113
• CWE-74

• https://gist.github.com/dellalibera/9247769cc90ed96c0d72ddbcba88c65cExploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-UNMANAGED-CROW-5665556Third Party Advisory
• https://gist.github.com/dellalibera/9247769cc90ed96c0d72ddbcba88c65cExploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-UNMANAGED-CROW-5665556Third Party Advisory

Published

Sep 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26137All versions of the package drogonframework/drogon are vulne…6.1
• CVE-2023-26138All versions of the package drogonframework/drogon are vulne…4.3
• CVE-2023-26139Versions of the package underscore-keypath from 0.0.11 are v…7.5
• CVE-2023-2614Cross-site Scripting (XSS) - DOM in GitHub repository pimcor…5.4
• CVE-2023-26140Versions of the package @excalidraw/excalidraw from 0.0.0 ar…6.1
• CVE-2023-26141Versions of the package sidekiq before 7.1.3 are vulnerable …4.9
• CVE-2023-26143Versions of the package blamer before 1.0.4 are vulnerable t…9.1
• CVE-2023-26144Versions of the package graphql from 16.3.0 and before 16.8.…5.3
• CVE-2023-26145This affects versions of the package pydash before 6.0.0. A …8.1
• CVE-2023-26146All versions of the package ithewei/libhv are vulnerable to …6.1
• CVE-2023-26147All versions of the package ithewei/libhv are vulnerable to …6.1
• CVE-2023-26148All versions of the package ithewei/libhv are vulnerable to …5.3