CVE-2016-1133

low-risk
Published 2016-01-16

CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI.

Do I need to act?

-
0.39% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.7/10 Low
NETWORK / HIGH complexity

Affected Products (2)

H2O
H2O

Affected Vendors

Dena

References (10)

Vendor Advisory http://jvn.jp/en/jp/JVN45928828/index.html
Vendor Advisory http://jvndb.jvn.jp/jvndb/JVNDB-2016-000003
https://github.com/h2o/h2o/issues/682
https://github.com/h2o/h2o/issues/684
https://h2o.examp1e.net/vulnerabilities.html#CVE-2016-1133
Vendor Advisory http://jvn.jp/en/jp/JVN45928828/index.html
Vendor Advisory http://jvndb.jvn.jp/jvndb/JVNDB-2016-000003
https://github.com/h2o/h2o/issues/682
https://github.com/h2o/h2o/issues/684
https://h2o.examp1e.net/vulnerabilities.html#CVE-2016-1133
21
/ 100
low-risk
Severity 13/34 · Low
Exploitability 1/34 · Minimal
Exposure 7/34 · Low