CVE-2016-1133

published 2016-01-16

CVE-2016-1133: CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to…

low 3.7 CVSS 3.0

AV N AC H PR N UI N S U C N I L A N

CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	h2o	—	—
dena	h2o	<= 1.6.1	—
dena	h2o	—	—