CVE-2026-34715

ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content, leading to response splitting, cache poisoning, and possible cross-site scripting. Notably, ewe does validate CRLF in incoming request headers via validate_field_value() in the HTTP/1.1 parser — but provides no equivalent protection for outgoing response headers in the encoder. This issue has been patched in version 3.0.6.

• CWE-113

• https://github.com/vshakitskiy/ewe/commit/ce4ff214d32626a10fda9398dc94a2d720e17446Patch
• https://github.com/vshakitskiy/ewe/releases/tag/v3.0.6Product, Release Notes
• https://github.com/vshakitskiy/ewe/security/advisories/GHSA-x2w3-23jr-hrpfExploit, Vendor Advisory
• https://github.com/vshakitskiy/ewe/security/advisories/GHSA-x2w3-23jr-hrpfExploit, Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3471Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to…6.5
• CVE-2026-34710Substance3D - Sampler versions 6.0.0 and earlier are affecte…7.8
• CVE-2026-34711CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.…7.5
• CVE-2026-34712CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.…7.5
• CVE-2026-34713CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.…7.5
• CVE-2026-34714Vim before 9.2.0272 allows code execution that happens immed…8.6
• CVE-2026-34716WWBN AVideo is an open source video platform. In versions 26…6.4
• CVE-2026-34717OpenProject is an open-source, web-based project management …8.1
• CVE-2026-34718Zammad is a web based open source helpdesk/customer support …6.1
• CVE-2026-34719Zammad is a web based open source helpdesk/customer support …4.3
• CVE-2026-3472Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 1…3.5
• CVE-2026-34720Zammad is a web based open source helpdesk/customer support …4.3