FKIE_CVE-2026-24489

Vulnerability from fkie_nvd - Published: 2026-01-27 01:16 - Updated: 2026-06-17 10:23
Severity
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allowed HTTP header injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names. When making HTTP requests with user-controlled header values containing `\r\n` (CRLF), `\n` (LF), or `\x00` (null byte) characters, an attacker could inject arbitrary HTTP headers into the request. The fix in version 0.1.1 adds a `_sanitize_header()` function that strips `\r`, `\n`, and `\x00` characters from both header names and values before they are included in HTTP requests.
References
security-advisories@github.comhttps://github.com/HappyHackingSpace/gakido/commit/369c67e67c63da510c8a9ab021e54a92ccf1f788
security-advisories@github.comhttps://github.com/HappyHackingSpace/gakido/releases/tag/v0.1.1-1bc6019
security-advisories@github.comhttps://github.com/HappyHackingSpace/gakido/security/advisories/GHSA-gcgx-chcp-hxp9
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "gakido",
          "vendor": "HappyHackingSpace",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.1.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allowed HTTP header injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names. When making HTTP requests with user-controlled header values containing `\\r\\n` (CRLF), `\\n` (LF), or `\\x00` (null byte) characters, an attacker could inject arbitrary HTTP headers into the request. The fix in version 0.1.1 adds a `_sanitize_header()` function that strips `\\r`, `\\n`, and `\\x00` characters from both header names and values before they are included in HTTP requests."
    },
    {
      "lang": "es",
      "value": "Gakido es un cliente HTTP de Python centrado en la suplantaci\u00f3n de navegadores y la evasi\u00f3n de bots. Se descubri\u00f3 una vulnerabilidad en Gakido anterior a la versi\u00f3n 0.1.1 que permit\u00eda la inyecci\u00f3n de encabezados HTTP a trav\u00e9s de secuencias CRLF (retorno de carro y salto de l\u00ednea) en los valores y nombres de los encabezados proporcionados por el usuario. Al realizar solicitudes HTTP con valores de encabezado controlados por el usuario que contienen caracteres `\\r\\n` (CRLF), `\\n` (LF) o `\\x00` (byte nulo), un atacante pod\u00eda inyectar encabezados HTTP arbitrarios en la solicitud. La correcci\u00f3n en la versi\u00f3n 0.1.1 a\u00f1ade una funci\u00f3n `_sanitize_header()` que elimina los caracteres `\\r`, `\\n` y `\\x00` tanto de los nombres como de los valores de los encabezados antes de que se incluyan en las solicitudes HTTP."
    }
  ],
  "id": "CVE-2026-24489",
  "lastModified": "2026-06-17T10:23:08.793",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24489",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-27T14:46:28.507941Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-27T01:16:02.453",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HappyHackingSpace/gakido/commit/369c67e67c63da510c8a9ab021e54a92ccf1f788"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HappyHackingSpace/gakido/releases/tag/v0.1.1-1bc6019"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/HappyHackingSpace/gakido/security/advisories/GHSA-gcgx-chcp-hxp9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        },
        {
          "lang": "en",
          "value": "CWE-113"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.