https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 15:45:03 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-73117 <p>Improper Neutralization of CRLF Sequences in HTTP Headers (&#39;HTTP Response Splitting&#39;) vulnerability in Apache Juneau.</p> <p>The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code.</p> <p>This issue affects Apache Juneau: through 9.2.0.</p> <p>Users are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().</p> <p>Improper Neutralization of CRLF Sequences in HTTP Headers (&#39;HTTP Response Splitting&#39;) vulnerability in Apache Juneau.</p> <p>The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code.</p> <p>This issue affects Apache Juneau: through 9.2.0.</p> <p>Users are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().</p> https://db.gcve.eu/vuln/fkie_cve-2026-73117 https://db.gcve.eu/vuln/ghsa-rw79-jgjp-5w92 <p>Improper Neutralization of CRLF Sequences in HTTP Headers (&#39;HTTP Response Splitting&#39;) vulnerability in Apache Juneau.</p> <p>The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code.</p> <p>This issue affects Apache Juneau: through 9.2.0.</p> <p>Users are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().</p> <p>Improper Neutralization of CRLF Sequences in HTTP Headers (&#39;HTTP Response Splitting&#39;) vulnerability in Apache Juneau.</p> <p>The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target from request data could let a remote client inject header lines (where the servlet container does not itself reject CR/LF) or redirect users to an arbitrary external site. The framework itself does not build headers or redirects from request data; exposure depends on application code.</p> <p>This issue affects Apache Juneau: through 9.2.0.</p> <p>Users are recommended to upgrade to version 9.2.1, which fixes the issue. Header values are now sanitized by default; applications that build redirect targets from request data must also switch from sendRedirect() to the new sendSafeRedirect().</p> https://db.gcve.eu/vuln/ghsa-rw79-jgjp-5w92