CWE-436
Allowed-with-ReviewInterpretation Conflict
Abstraction: Class · Status: Incomplete
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
246 vulnerabilities reference this CWE, most recent first.
GHSA-HH82-3PMQ-7FRP
Vulnerability from github – Published: 2022-12-12 21:25 – Updated: 2023-01-10 23:07Impact
When calling DefaultHttpHeaders.set with an iterator of values (as opposed to a single given value), header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting.
Patches
The necessary validation was added in Netty 4.1.86.Final.
Workarounds
Integrators can work around the issue by changing the DefaultHttpHeaders.set(CharSequence, Iterator<?>) call, into a remove() call, and call add() in a loop over the iterator of values.
References
HTTP Response Splitting CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers
For more information
If you have any questions or comments about this advisory: * Open an issue in [example link to repo](https://github.com/netty/netty) * Email us at netty-security@googlegroups.com
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.83.Final"
},
{
"fixed": "4.1.86.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-41915"
],
"database_specific": {
"cwe_ids": [
"CWE-113",
"CWE-436"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-12T21:25:44Z",
"nvd_published_at": "2022-12-13T07:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nWhen calling `DefaultHttpHeaders.set` with an _iterator_ of values (as opposed to a single given value), header value validation was not performed, allowing malicious header values in the iterator to perform [HTTP Response Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting).\n\n### Patches\nThe necessary validation was added in Netty 4.1.86.Final.\n\n### Workarounds\nIntegrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator\u003c?\u003e)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.\n\n### References\n[HTTP Response Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)\n[CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers](https://cwe.mitre.org/data/definitions/113.html)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [[example link to repo](https://github.com/netty/netty)](https://github.com/netty/netty)\n* Email us at [netty-security@googlegroups.com](mailto:netty-security@googlegroups.com)\n",
"id": "GHSA-hh82-3pmq-7frp",
"modified": "2023-01-10T23:07:13Z",
"published": "2022-12-12T21:25:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41915"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/issues/13084"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/pull/12760"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/commit/c37c637f096e7be3dffd36edee3455c8e90cb1b0"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230113-0004"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5316"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Netty vulnerable to HTTP Response splitting from assigning header value iterator"
}
GHSA-HRWM-HGMJ-7P9C
Vulnerability from github – Published: 2026-04-16 01:03 – Updated: 2026-04-16 01:03Summary
@fastify/express v4.0.4 contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. This results in complete bypass of Express middleware security controls for all routes defined within child plugin scopes that share a prefix with parent-scoped middleware. No special configuration is required — this affects the default Fastify configuration.
Details
The vulnerability exists in the onRegister function at index.js lines 92-101. When a child plugin is registered with a prefix, the onRegister hook copies middleware from the parent scope and re-registers it using instance.use(...middleware). However, the middleware paths stored in kMiddlewares are already prefixed from their original registration.
The call flow demonstrates the problem:
1. Parent scope registers middleware: app.use('/admin', authFn) — use() calculates path as '' + '/admin' = '/admin' — stores ['/admin', authFn] in kMiddlewares
2. Child plugin registers with { prefix: '/admin' } — triggers onRegister(instance)
3. onRegister copies parent middleware and calls instance.use('/admin', authFn) on child
4. Child's use() function calculates path as '/admin' + '/admin' = '/admin/admin' — registers middleware with doubled path
5. Routes in child scope use the child's Express instance, where middleware is registered under the incorrect path /admin/admin
6. Requests to /admin/secret don't match /admin/admin — middleware is silently skipped
The root cause is in the use() function at lines 25-26, which always prepends this.prefix to string paths, combined with onRegister re-calling use() with already-prefixed paths.
PoC
const fastify = require('fastify');
const http = require('http');
function get(port, url) {
return new Promise((resolve, reject) => {
http.get('http://localhost:' + port + url, (res) => {
let data = '';
res.on('data', (chunk) => data += chunk);
res.on('end', () => resolve({ status: res.statusCode, body: data }));
}).on('error', reject);
});
}
async function test() {
const app = fastify({ logger: false });
await app.register(require('@fastify/express'));
// Middleware enforcing auth on /admin routes
app.use('/admin', function(req, res, next) {
if (!req.headers.authorization) {
res.statusCode = 403;
res.setHeader('content-type', 'application/json');
res.end(JSON.stringify({ error: 'Forbidden' }));
return;
}
next();
});
// Root scope route — middleware works correctly
app.get('/admin/root-data', async () => ({ data: 'root-secret' }));
// Child scope route — middleware BYPASSED
await app.register(async function(child) {
child.get('/secret', async () => ({ data: 'child-secret' }));
}, { prefix: '/admin' });
await app.listen({ port: 19876, host: '0.0.0.0' });
// Root scope: correctly blocked
let r = await get(19876, '/admin/root-data');
console.log('/admin/root-data (no auth):', r.status, r.body);
// Output: 403 {"error":"Forbidden"}
// Child scope: BYPASSED — secret data returned without auth
r = await get(19876, '/admin/secret');
console.log('/admin/secret (no auth):', r.status, r.body);
// Output: 200 {"data":"child-secret"}
await app.close();
}
test();
Actual output:
/admin/root-data (no auth): 403 {"error":"Forbidden"}
/admin/secret (no auth): 200 {"data":"child-secret"}
Impact
Complete bypass of Express middleware security controls for all routes defined in child plugin scopes. Authentication, authorization, rate limiting, CSRF protection, audit logging, and any other middleware-based security mechanisms are silently skipped for affected routes.
- No special request crafting is required — normal requests bypass the middleware
- It affects the idiomatic Fastify plugin pattern commonly used in production
- The bypass is silent with no errors or warnings
- Developers' basic testing of root-scoped routes will pass, masking the vulnerability
- Any child plugin scope that shares a prefix with middleware is affected
Applications using @fastify/express with path-scoped middleware and child plugins with matching prefixes are vulnerable in default configurations.
Affected Versions
@fastify/expressv4.0.4 (latest at time of discovery)- Fastify 5.x in default configuration
- No special router options required (
ignoreDuplicateSlashesnot needed) - Affects any child plugin registration where the prefix overlaps with middleware path scoping
- Does NOT affect middleware registered without path scoping (global middleware)
- Does NOT affect middleware registered on root path (
/) due to special case handling
Variant Testing
| Scenario | Middleware Path | Child Prefix | Result |
|---|---|---|---|
Root route /admin/root-data |
/admin |
N/A | Middleware runs (403) |
Child route /admin/secret |
/admin |
/admin |
BYPASS (200) |
Child route /api/data |
/api |
/api |
BYPASS (200) |
Nested child /admin/sub/data |
/admin |
/admin/sub |
BYPASS — path becomes /admin/sub/admin |
Middleware on / with any child |
/ |
/api |
No bypass — path === '/' && prefix.length > 0 special case |
Suggested Fix
The onRegister function should store and re-use the original unprefixed middleware paths, or avoid re-calling the use() function entirely. Options include:
1. Store the original path and function separately in kMiddlewares before prefixing
2. Strip the parent prefix before re-registering in child scopes
3. Store already-constructed Express middleware objects rather than re-processing paths
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.0.4"
},
"package": {
"ecosystem": "npm",
"name": "@fastify/express"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33807"
],
"database_specific": {
"cwe_ids": [
"CWE-436"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T01:03:25Z",
"nvd_published_at": "2026-04-15T10:16:48Z",
"severity": "CRITICAL"
},
"details": "### Summary\n\n`@fastify/express` v4.0.4 contains a path handling bug in the `onRegister` function that causes middleware paths to be doubled when inherited by child plugins. This results in complete bypass of Express middleware security controls for all routes defined within child plugin scopes that share a prefix with parent-scoped middleware. No special configuration is required \u2014 this affects the default Fastify configuration.\n\n### Details\n\nThe vulnerability exists in the `onRegister` function at `index.js` lines 92-101. When a child plugin is registered with a prefix, the `onRegister` hook copies middleware from the parent scope and re-registers it using `instance.use(...middleware)`. However, the middleware paths stored in `kMiddlewares` are already prefixed from their original registration.\n\nThe call flow demonstrates the problem:\n1. Parent scope registers middleware: `app.use(\u0027/admin\u0027, authFn)` \u2014 `use()` calculates path as `\u0027\u0027 + \u0027/admin\u0027 = \u0027/admin\u0027` \u2014 stores `[\u0027/admin\u0027, authFn]` in `kMiddlewares`\n2. Child plugin registers with `{ prefix: \u0027/admin\u0027 }` \u2014 triggers `onRegister(instance)`\n3. `onRegister` copies parent middleware and calls `instance.use(\u0027/admin\u0027, authFn)` on child\n4. Child\u0027s `use()` function calculates path as `\u0027/admin\u0027 + \u0027/admin\u0027 = \u0027/admin/admin\u0027` \u2014 registers middleware with doubled path\n5. Routes in child scope use the child\u0027s Express instance, where middleware is registered under the incorrect path `/admin/admin`\n6. Requests to `/admin/secret` don\u0027t match `/admin/admin` \u2014 middleware is silently skipped\n\nThe root cause is in the `use()` function at lines 25-26, which always prepends `this.prefix` to string paths, combined with `onRegister` re-calling `use()` with already-prefixed paths.\n\n### PoC\n\n```javascript\nconst fastify = require(\u0027fastify\u0027);\nconst http = require(\u0027http\u0027);\n\nfunction get(port, url) {\n return new Promise((resolve, reject) =\u003e {\n http.get(\u0027http://localhost:\u0027 + port + url, (res) =\u003e {\n let data = \u0027\u0027;\n res.on(\u0027data\u0027, (chunk) =\u003e data += chunk);\n res.on(\u0027end\u0027, () =\u003e resolve({ status: res.statusCode, body: data }));\n }).on(\u0027error\u0027, reject);\n });\n}\n\nasync function test() {\n const app = fastify({ logger: false });\n await app.register(require(\u0027@fastify/express\u0027));\n \n // Middleware enforcing auth on /admin routes\n app.use(\u0027/admin\u0027, function(req, res, next) {\n if (!req.headers.authorization) {\n res.statusCode = 403;\n res.setHeader(\u0027content-type\u0027, \u0027application/json\u0027);\n res.end(JSON.stringify({ error: \u0027Forbidden\u0027 }));\n return;\n }\n next();\n });\n \n // Root scope route \u2014 middleware works correctly\n app.get(\u0027/admin/root-data\u0027, async () =\u003e ({ data: \u0027root-secret\u0027 }));\n \n // Child scope route \u2014 middleware BYPASSED\n await app.register(async function(child) {\n child.get(\u0027/secret\u0027, async () =\u003e ({ data: \u0027child-secret\u0027 }));\n }, { prefix: \u0027/admin\u0027 });\n \n await app.listen({ port: 19876, host: \u00270.0.0.0\u0027 });\n \n // Root scope: correctly blocked\n let r = await get(19876, \u0027/admin/root-data\u0027);\n console.log(\u0027/admin/root-data (no auth):\u0027, r.status, r.body);\n // Output: 403 {\"error\":\"Forbidden\"}\n \n // Child scope: BYPASSED \u2014 secret data returned without auth\n r = await get(19876, \u0027/admin/secret\u0027);\n console.log(\u0027/admin/secret (no auth):\u0027, r.status, r.body);\n // Output: 200 {\"data\":\"child-secret\"}\n \n await app.close();\n}\ntest();\n```\n\nActual output:\n```\n/admin/root-data (no auth): 403 {\"error\":\"Forbidden\"}\n/admin/secret (no auth): 200 {\"data\":\"child-secret\"}\n```\n\n### Impact\n\nComplete bypass of Express middleware security controls for all routes defined in child plugin scopes. Authentication, authorization, rate limiting, CSRF protection, audit logging, and any other middleware-based security mechanisms are silently skipped for affected routes.\n\n- No special request crafting is required \u2014 normal requests bypass the middleware\n- It affects the idiomatic Fastify plugin pattern commonly used in production\n- The bypass is silent with no errors or warnings\n- Developers\u0027 basic testing of root-scoped routes will pass, masking the vulnerability\n- Any child plugin scope that shares a prefix with middleware is affected\n\nApplications using `@fastify/express` with path-scoped middleware and child plugins with matching prefixes are vulnerable in default configurations.\n\n### Affected Versions\n\n- `@fastify/express` v4.0.4 (latest at time of discovery)\n- Fastify 5.x in default configuration\n- No special router options required (`ignoreDuplicateSlashes` not needed)\n- Affects any child plugin registration where the prefix overlaps with middleware path scoping\n- Does NOT affect middleware registered without path scoping (global middleware)\n- Does NOT affect middleware registered on root path (`/`) due to special case handling\n\n### Variant Testing\n\n| Scenario | Middleware Path | Child Prefix | Result |\n|---|---|---|---|\n| Root route `/admin/root-data` | `/admin` | N/A | Middleware runs (403) |\n| Child route `/admin/secret` | `/admin` | `/admin` | **BYPASS** (200) |\n| Child route `/api/data` | `/api` | `/api` | **BYPASS** (200) |\n| Nested child `/admin/sub/data` | `/admin` | `/admin/sub` | **BYPASS** \u2014 path becomes `/admin/sub/admin` |\n| Middleware on `/` with any child | `/` | `/api` | No bypass \u2014 `path === \u0027/\u0027 \u0026\u0026 prefix.length \u003e 0` special case |\n\n### Suggested Fix\n\nThe `onRegister` function should store and re-use the original unprefixed middleware paths, or avoid re-calling the `use()` function entirely. Options include:\n1. Store the original path and function separately in `kMiddlewares` before prefixing\n2. Strip the parent prefix before re-registering in child scopes\n3. Store already-constructed Express middleware objects rather than re-processing paths",
"id": "GHSA-hrwm-hgmj-7p9c",
"modified": "2026-04-16T01:03:25Z",
"published": "2026-04-16T01:03:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33807"
},
{
"type": "WEB",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/fastify/fastify-express"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "@fastify/express\u0027s middleware path doubling causes authentication bypass in child plugin scopes"
}
GHSA-HWPQ-RRPF-PGCQ
Vulnerability from github – Published: 2026-03-02 23:33 – Updated: 2026-03-30 13:44Summary
system.run approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<= 2026.2.24 - Patched versions:
>= 2026.2.25
Impact
This is an approval-integrity bypass that can lead to unexpected command execution under the OpenClaw runtime user when an attacker can influence command argv and reuse/obtain a matching approval context.
Trust Model Note
OpenClaw does not treat adversarial multi-user sharing of one gateway host/config as a supported security boundary. This finding is still valid in supported deployments because it breaks the operator approval boundary itself (approved display command vs executed argv).
Fix Commit(s)
03e689fc89bbecbcd02876a95957ef1ad9caa176
Release Process Note
patched_versions is pre-set to the release (2026.2.25). Advisory published with npm release 2026.2.25.
OpenClaw thanks @tdjackey for reporting.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.2.24"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.2.25"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32065"
],
"database_specific": {
"cwe_ids": [
"CWE-436",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-02T23:33:08Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n`system.run` approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.24`\n- Patched versions: `\u003e= 2026.2.25`\n\n### Impact\nThis is an approval-integrity bypass that can lead to unexpected command execution under the OpenClaw runtime user when an attacker can influence `command` argv and reuse/obtain a matching approval context.\n\n### Trust Model Note\nOpenClaw does not treat adversarial multi-user sharing of one gateway host/config as a supported security boundary. This finding is still valid in supported deployments because it breaks the operator approval boundary itself (approved display command vs executed argv).\n\n### Fix Commit(s)\n- `03e689fc89bbecbcd02876a95957ef1ad9caa176`\n\n### Release Process Note\n`patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.\n\nOpenClaw thanks @tdjackey for reporting.",
"id": "GHSA-hwpq-rrpf-pgcq",
"modified": "2026-03-30T13:44:16Z",
"published": "2026-03-02T23:33:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-hwpq-rrpf-pgcq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32065"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/03e689fc89bbecbcd02876a95957ef1ad9caa176"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-approval-identity-mismatch-in-system-run-command-execution"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: system.run approval identity mismatch could execute a different binary than displayed"
}
GHSA-J4H9-PM27-4RFW
Vulnerability from github – Published: 2026-06-23 18:03 – Updated: 2026-08-21 18:28Impact
OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the FILE_UPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability was already reported as GHSA-m9jh-jf9h-x3h2/CVE-2025-48067 but the fix provided in OctoPrint 1.11.2 turned out to be incomplete.
The primary risk lies in the potential exfiltration of secrets stored inside OctoPrint's config, or further system files. By removing important runtime files, this could also be used to impact the availability of the host after an attempted server restart. Given that the attacker requires a user account with file upload permissions, the actual impact of this should however hopefully be minimal in most cases.
Patches
The vulnerability has been patched in version 1.11.8 and 2.0.0rc3.
Details
OctoPrint's web application is implemented in Flask, but uploads are first intercepted by a custom upload handler built on Tornado that sits in front of it. The handler streams the upload to a temporary file on disk - so files larger than the available memory can be uploaded - and rewrites the request, adding internal form fields that tell Flask where to find that temporary file.
These fields are reserved and meant to be set only by the upload handler, never by the client. The previous fix from GHSA-m9jh-jf9h-x3h2/CVE-2025-48067 stripped them from the request received from the client when they were sent as multipart form fields, yet they could still reach Flask through other channels: as plain query parameters, or - since the Tornado handler and Flask did not parse requests identically - smuggled in via several "parser differentials" that looked harmless to the handler while Flask still saw the injected fields. Any of these let an attacker make OctoPrint treat an arbitrary file on the host as a freshly uploaded one and move it into the upload folder.
The following endpoints in OctoPrint are affected:
/api/files/{local|sdcard}/api/languages/plugin/backup/restore/plugin/pluginmanager/upload_file
Further upload endpoints in third party plugins might be affected too.
The fix rejects requests carrying any of the reserved fields, aligns the Tornado handler's request parsing with Flask's (Werkzeug) to avoid any differential parsing, and re-validates the request rewritten by Tornado before forwarding it to Flask.
Credits
This vulnerability was discovered and responsibly disclosed to OctoPrint by Koh Jun Sheng and Jacopo Tediosi.
Timeline
2026-06-04: Report received 2026-06-04: Report acknowledged 2026-06-08: Report verified 2026-06-17: Fix ready for 1.11.x 2026-06-22: Fix ported to 2.0.0 2026-06-23: Fix released with 1.11.8 and 2.0.0rc3
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.11.7"
},
"package": {
"ecosystem": "PyPI",
"name": "OctoPrint"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.0rc2"
},
"package": {
"ecosystem": "PyPI",
"name": "OctoPrint"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0rc1"
},
{
"fixed": "2.0.0rc3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54134"
],
"database_specific": {
"cwe_ids": [
"CWE-436",
"CWE-73"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-23T18:03:54Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nOctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the `FILE_UPLOAD` permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability was already reported as [GHSA-m9jh-jf9h-x3h2/CVE-2025-48067](https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-m9jh-jf9h-x3h2) but the fix provided in OctoPrint 1.11.2 turned out to be incomplete.\n\nThe primary risk lies in the potential exfiltration of secrets stored inside OctoPrint\u0027s config, or further system files. By removing important runtime files, this could also be used to impact the availability of the host after an attempted server restart. Given that the attacker requires a user account with file upload permissions, the actual impact of this should however hopefully be minimal in most cases.\n\n### Patches\n\nThe vulnerability has been patched in version 1.11.8 and 2.0.0rc3.\n\n### Details\n\nOctoPrint\u0027s web application is implemented in Flask, but uploads are first intercepted by a custom upload handler built on Tornado that sits in front of it. The handler streams the upload to a temporary file on disk - so files larger than the available memory can be uploaded - and rewrites the request, adding internal form fields that tell Flask where to find that temporary file.\n\nThese fields are reserved and meant to be set only by the upload handler, never by the client. The previous fix from [GHSA-m9jh-jf9h-x3h2/CVE-2025-48067](https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-m9jh-jf9h-x3h2) stripped them from the request received from the client when they were sent as multipart form fields, yet they could still reach Flask through other channels: as plain query parameters, or - since the Tornado handler and Flask did not parse requests identically - smuggled in via several \"parser differentials\" that looked harmless to the handler while Flask still saw the injected fields. Any of these let an attacker make OctoPrint treat an arbitrary file on the host as a freshly uploaded one and move it into the upload folder.\n\nThe following endpoints in OctoPrint are affected:\n\n- `/api/files/{local|sdcard}`\n- `/api/languages`\n- `/plugin/backup/restore`\n- `/plugin/pluginmanager/upload_file`\n\nFurther upload endpoints in third party plugins might be affected too.\n\nThe fix rejects requests carrying any of the reserved fields, aligns the Tornado handler\u0027s request parsing with Flask\u0027s (Werkzeug) to avoid any differential parsing, and re-validates the request rewritten by Tornado before forwarding it to Flask.\n\n### Credits\n\nThis vulnerability was discovered and responsibly disclosed to OctoPrint by Koh Jun Sheng and Jacopo Tediosi.\n\n### Timeline\n\n2026-06-04: Report received\n2026-06-04: Report acknowledged\n2026-06-08: Report verified\n2026-06-17: Fix ready for 1.11.x\n2026-06-22: Fix ported to 2.0.0\n2026-06-23: Fix released with 1.11.8 and 2.0.0rc3",
"id": "GHSA-j4h9-pm27-4rfw",
"modified": "2026-08-21T18:28:35Z",
"published": "2026-06-23T18:03:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-j4h9-pm27-4rfw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54134"
},
{
"type": "PACKAGE",
"url": "https://github.com/OctoPrint/OctoPrint"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2026-2687.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OctoPrint has possible file exfiltration via query parameters on upload endpoints"
}
GHSA-J4JC-CQ9H-XRHR
Vulnerability from github – Published: 2026-08-12 18:31 – Updated: 2026-08-13 15:34Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill_id path segment failed to parse. The authorization dependency parsed it with int() while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int() rejects (1.0 coerces to 1); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on any single Dag could therefore read, pause and cancel backfills belonging to any other Dag, including moving another Dag's queued runs to failed. No non-default configuration is required and backfill ids are sequential, so finding a target is trivial. Users are advised to upgrade to apache-airflow 3.3.1 or later, which parses the backfill id with the same type the routes declare.
{
"affected": [],
"aliases": [
"CVE-2026-68968"
],
"database_specific": {
"cwe_ids": [
"CWE-436"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-12T16:17:19Z",
"severity": "HIGH"
},
"details": "Apache Airflow\u0027s Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authorization dependency parsed it with `int()` while the route handler parsed it as pydantic\u0027s `NonNegativeInt`, which accepts values `int()` rejects (`1.0` coerces to `1`); FastAPI resolves dependencies before endpoint validation, so the two acted on different Dags. An authenticated user holding edit permission on any single Dag could therefore read, pause and cancel backfills belonging to any other Dag, including moving another Dag\u0027s queued runs to `failed`. No non-default configuration is required and backfill ids are sequential, so finding a target is trivial. Users are advised to upgrade to apache-airflow 3.3.1 or later, which parses the backfill id with the same type the routes declare.",
"id": "GHSA-j4jc-cq9h-xrhr",
"modified": "2026-08-13T15:34:29Z",
"published": "2026-08-12T18:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68968"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/70889"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/f9zmw6xs5b4syhwzbl6fsxm4kf2632ol"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/12/12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JJ37-3377-M6VV
Vulnerability from github – Published: 2025-11-14 21:30 – Updated: 2026-05-13 13:45Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-mm7p-fcc7-pg87. This link is maintained to preserve external references.
Original Description
A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nodemailer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1286",
"CWE-436"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-17T17:17:33Z",
"nvd_published_at": "2025-11-14T20:15:45Z",
"severity": "HIGH"
},
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-mm7p-fcc7-pg87. This link is maintained to preserve external references.\n\n## Original Description\nA vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker\u0027s external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.",
"id": "GHSA-jj37-3377-m6vv",
"modified": "2026-05-13T13:45:17Z",
"published": "2025-11-14T21:30:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13033"
},
{
"type": "WEB",
"url": "https://github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:15979"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3751"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-13033"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402179"
},
{
"type": "PACKAGE",
"url": "https://github.com/nodemailer/nodemailer"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict",
"withdrawn": "2025-11-17T17:17:33Z"
}
GHSA-JR45-8VMC-QM54
Vulnerability from github – Published: 2026-08-03 19:32 – Updated: 2026-08-03 19:32Impact
Undici's cache interceptor mishandles optional whitespace (OWS) placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" (OWS before =) or no-cache= "authorization" (OWS after =). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.
In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-= bypass that the earlier fix did not normalize.
Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives whose field-name list is padded with OWS around the =.
Patches
Upgrade to undici v7.29.0 or v8.9.0.
Workarounds
If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "undici"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.29.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "undici"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-14643"
],
"database_specific": {
"cwe_ids": [
"CWE-436",
"CWE-524"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-03T19:32:12Z",
"nvd_published_at": "2026-07-29T22:16:52Z",
"severity": "MODERATE"
},
"details": "## Impact\n\nUndici\u0027s cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cache` or `private` Cache-Control directive, such as `no-cache =\"authorization\"` (OWS before `=`) or `no-cache= \"authorization\"` (OWS after `=`). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user\u0027s authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-`=` bypass that the earlier fix did not normalize.\n\nAffected applications are those that explicitly enable the cache interceptor (`interceptors.cache()`) in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with qualified `private` or `no-cache` directives whose field-name list is padded with OWS around the `=`.\n\n## Patches\n\nUpgrade to undici v7.29.0 or v8.9.0.\n\n## Workarounds\n\nIf upgrade is not immediately possible, disable shared-cache mode for traffic that includes `Authorization` headers, avoid caching responses to authenticated requests, or add `Vary: Authorization` upstream.",
"id": "GHSA-jr45-8vmc-qm54",
"modified": "2026-08-03T19:32:12Z",
"published": "2026-08-03T19:32:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14643"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/commit/85a240551c9feb8b8a0ecc56c84b2b3015add8a9"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/commit/cb105d7c79069150982fa11acada0dd94a60dbbc"
},
{
"type": "WEB",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/nodejs/undici"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/releases/tag/v7.29.0"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/undici/releases/tag/v8.9.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives"
}
GHSA-JX2C-RXCM-JVMQ
Vulnerability from github – Published: 2026-02-02 22:23 – Updated: 2026-02-04 17:46Impact
A validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.
For example, a request with Content-Type: application/json\ta will bypass JSON schema validation but still be parsed as JSON.
This vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.
This issue is a regression or missed edge case from the fix for a previously reported vulnerability.
Patches
This vulnerability has been patched in Fastify v5.7.2. All users should upgrade to this version or later immediately.
Workarounds
If upgrading is not immediately possible, user can implement a custom onRequest hook to reject requests containing tab characters in the Content-Type header:
fastify.addHook('onRequest', async (request, reply) => {
const contentType = request.headers['content-type']
if (contentType && contentType.includes('\t')) {
reply.code(400).send({ error: 'Invalid Content-Type header' })
}
})
Resources
- https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272
- https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125
- Fastify Validation and Serialization Documentation
- https://hackerone.com/reports/3464114
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "fastify"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25223"
],
"database_specific": {
"cwe_ids": [
"CWE-436"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-02T22:23:29Z",
"nvd_published_at": "2026-02-03T22:16:31Z",
"severity": "HIGH"
},
"details": "### Impact\n\nA validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (`\\t`) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type.\n\nFor example, a request with `Content-Type: application/json\\ta` will bypass JSON schema validation but still be parsed as JSON.\n\nThis vulnerability affects all Fastify users who rely on Content-Type-based body validation schemas to enforce data integrity or security constraints. The concrete impact depends on the handler implementation and the level of trust placed in the validated request body, but at the library level, this allows complete bypass of body validation for any handler using Content-Type-discriminated schemas.\n\nThis issue is a regression or missed edge case from the fix for a previously reported vulnerability.\n\n### Patches\n\nThis vulnerability has been patched in **Fastify v5.7.2**. All users should upgrade to this version or later immediately.\n\n### Workarounds\n\nIf upgrading is not immediately possible, user can implement a custom `onRequest` hook to reject requests containing tab characters in the Content-Type header:\n\n```javascript\nfastify.addHook(\u0027onRequest\u0027, async (request, reply) =\u003e {\n const contentType = request.headers[\u0027content-type\u0027]\n if (contentType \u0026\u0026 contentType.includes(\u0027\\t\u0027)) {\n reply.code(400).send({ error: \u0027Invalid Content-Type header\u0027 })\n }\n})\n```\n\n### Resources\n\n- https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272\n- https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125\n- [Fastify Validation and Serialization Documentation](https://fastify.dev/docs/latest/Reference/Validation-and-Serialization/)\n- https://hackerone.com/reports/3464114",
"id": "GHSA-jx2c-rxcm-jvmq",
"modified": "2026-02-04T17:46:02Z",
"published": "2026-02-02T22:23:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fastify/fastify/security/advisories/GHSA-jx2c-rxcm-jvmq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25223"
},
{
"type": "WEB",
"url": "https://github.com/fastify/fastify/commit/32d7b6add39ddf082d92579a58bea7018c5ac821"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3464114"
},
{
"type": "WEB",
"url": "https://fastify.dev/docs/latest/Reference/Validation-and-Serialization"
},
{
"type": "PACKAGE",
"url": "https://github.com/fastify/fastify"
},
{
"type": "WEB",
"url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/content-type-parser.js#L125"
},
{
"type": "WEB",
"url": "https://github.com/fastify/fastify/blob/759e9787b5669abf953068e42a17bffba7521348/lib/validation.js#L272"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Fastify\u0027s Content-Type header tab character allows body validation bypass"
}
GHSA-M29X-VP4P-2WVP
Vulnerability from github – Published: 2022-05-24 17:19 – Updated: 2024-04-04 02:51A vulnerability in the Secure Shell (SSH) server code of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. The vulnerability is due to an internal state not being represented correctly in the SSH state machine, which leads to an unexpected behavior. An attacker could exploit this vulnerability by creating an SSH connection to an affected device and using a specific traffic pattern that causes an error condition within that connection. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition.
{
"affected": [],
"aliases": [
"CVE-2020-3200"
],
"database_specific": {
"cwe_ids": [
"CWE-436"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-03T18:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the Secure Shell (SSH) server code of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. The vulnerability is due to an internal state not being represented correctly in the SSH state machine, which leads to an unexpected behavior. An attacker could exploit this vulnerability by creating an SSH connection to an affected device and using a specific traffic pattern that causes an error condition within that connection. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition.",
"id": "GHSA-m29x-vp4p-2wvp",
"modified": "2024-04-04T02:51:37Z",
"published": "2022-05-24T17:19:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3200"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssh-dos-Un22sd2A"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MCPX-CG54-VWC7
Vulnerability from github – Published: 2023-06-16 15:30 – Updated: 2024-04-04 04:55There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
{
"affected": [],
"aliases": [
"CVE-2022-48473"
],
"database_specific": {
"cwe_ids": [
"CWE-436"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-16T13:15:09Z",
"severity": "HIGH"
},
"details": "There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.",
"id": "GHSA-mcpx-cg54-vwc7",
"modified": "2024-04-04T04:55:00Z",
"published": "2023-06-16T15:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48473"
},
{
"type": "WEB",
"url": "https://https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-moivihp-2f201af9-en"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-105: HTTP Request Splitting
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to split a single HTTP request into multiple unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server).
See CanPrecede relationships for possible consequences.
CAPEC-273: HTTP Response Smuggling
An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server).
See CanPrecede relationships for possible consequences.
CAPEC-34: HTTP Response Splitting
An adversary manipulates and injects malicious content, in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., web server) or into an already spoofed HTTP response from an adversary controlled domain/site.
See CanPrecede relationships for possible consequences.