VulnerabilityModified
CVE-2022-35256
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.
MEDIUM 6.5EPSS 2.59%
Does this matter?
Lower severity and a low EPSS score (2.59%). Track it; it rarely justifies an emergency change on its own.
Description
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 2.59% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-444
- Affected
- nodejs/node.js · llhttp/llhttp · siemens/sinec ins · debian/debian linux
- Source
- support@hackerone.com
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdfThird Party Advisory
- https://hackerone.com/reports/1675191Exploit, Issue Tracking, Third Party Advisory
- https://www.debian.org/security/2023/dsa-5326Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdfThird Party Advisory
- https://hackerone.com/reports/1675191Exploit, Issue Tracking, Third Party Advisory
- https://www.debian.org/security/2023/dsa-5326Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.