By weakness (CWE)
CWE-113: related vulnerabilities
CVEs classified under CWE-113. Understanding the weakness class helps prioritize systemic fixes over one-off patches.
9 published vulnerabilities
- CVE-2026-50269HIGH 7.5
AIOHTTP, a popular Python framework for building asynchronous HTTP applications, contains a vulnerability in how it processes multipart request headers. If an application accepts user-controlled input and passes it directly into the header parameters of AIOHTTP's multipart functionality, an attacker can inject malicious headers or alter request contents. This affects versions prior to 3.14.0. The vulnerability requires the application developer to use user input in a specific way—passing it to MultipartWriter.append(headers=...) or Payload.headers—making it a conditional risk rather than a universal flaw in AIOHTTP itself.
- CVE-2026-9658HIGH 7.3
Plack::Middleware::Security::Common, a security middleware for Perl web applications, contains a flaw in how it filters HTTP header injection attacks when they appear in request paths. The middleware was designed to block header injections but only reliably caught attacks that were double-encoded. Single-encoded CRLF sequences (carriage return/line feed) embedded in request paths could slip through, potentially allowing attackers to inject malicious HTTP headers. The actual impact depends on how reverse proxies and the underlying Plack-based server process these malformed requests, which remains unclear in practice.
- CVE-2025-71381MEDIUM 6.5
Hono is a lightweight web framework used by developers to build fast APIs and web applications. A flaw in its CORS (Cross-Origin Resource Sharing) middleware allows attackers to inject arbitrary cache-control directives by manipulating the Vary header in requests. When a server reflects this attacker-supplied Vary value back in the response, it can poison how shared caches and proxies store and retrieve content, leading to inconsistent security policies and potential information leakage. The issue affects versions before 4.10.3.
- CVE-2026-50630MEDIUM 6.5
A flaw in Apache CXF's OAuth2 authentication mechanism allows attackers to inject line breaks into HTTP response headers. By crafting a malicious realm parameter, an attacker can trick the server into sending arbitrary headers or fragmenting the response entirely, potentially leading to session hijacking, cache poisoning, or other header-based attacks. The vulnerability affects versions before 4.2.2 and 4.1.7.
- CVE-2026-38978MEDIUM 5.3
Transmission, a popular BitTorrent application, contains a clickjacking vulnerability affecting versions up to and including 4.1.1. The flaw allows an attacker to trick users into performing unintended actions through the application's web interface or RPC (remote procedure call) endpoints by overlaying malicious content on top of legitimate interface elements. This requires user interaction but does not require the attacker to be authenticated or have any special privileges to exploit.
- CVE-2026-49214MEDIUM 5.3
guzzlehttp/psr7 versions before 2.10.2 fail to sanitize special characters in user-supplied URLs, allowing attackers to inject additional HTTP headers into outbound requests. If your application constructs HTTP requests from untrusted URLs—such as user input, forwarded requests, or webhook destinations—an attacker can craft a malicious URL that breaks out of the host parameter and injects fake headers like `X-Injected: yes`. This becomes especially dangerous when requests are relayed through proxies or load balancers, where the malformed headers can poison caches or trigger request smuggling attacks.
- CVE-2026-55766MEDIUM 4.8
guzzlehttp/psr7, a widely-used PHP library for handling HTTP messages, fails to properly sanitize certain HTTP protocol fields when processing attacker-controlled input. Specifically, carriage return and line feed (CR/LF) characters are not rejected in the request method, protocol version, and response reason phrase. If an application accepts untrusted data and uses psr7 to serialize messages for network transmission, an attacker could inject additional HTTP headers into the serialized output, potentially bypassing security controls or manipulating message intent. The vulnerability requires deliberate serialization to HTTP/1.x format; simply creating or modifying a PSR-7 object is not exploitable on its own.
- CVE-2026-47675MEDIUM 4.3
Hono, a JavaScript web framework, contains a flaw in how it sanitizes cookie options. While the framework validates certain cookie parameters (domain and path) to prevent malicious characters from breaking the Set-Cookie header, it fails to apply the same checks to sameSite and priority options. If an application passes user-controlled input directly into these parameters, an attacker could inject additional cookie attributes into the response header, potentially manipulating cookie behavior or setting unintended security policies.
- CVE-2026-44489LOW 3.7
Axios, a widely-used HTTP client library for JavaScript, contains a prototype pollution vulnerability in its configuration merging logic. When a developer uses Axios with a proxy configuration, an attacker can pollute the Object.prototype to inject fake username and password values. These polluted values are then automatically included in Proxy-Authorization headers sent with every proxied HTTP request, potentially leaking attacker-controlled credentials or disrupting authentication. The vulnerability affects Axios versions 1.15.2 through 1.15.x and is resolved in version 1.16.0.