CVEvulnerability
CVE-2019-17513
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-10-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-74
Description
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
Affected configurations
• ratpack project ratpack (< 1.7.5)
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://github.com/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23ae Patch
- https://github.com/ratpack/ratpack/commit/efb910d38a96494256f36675ef0e5061097dd77d Patch
- https://github.com/ratpack/ratpack/releases/tag/v1.7.5 Release Notes, Third Party Advisory
- https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j Third Party Advisory
- https://ratpack.io/versions/1.7.5 Vendor Advisory
- https://github.com/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23ae Patch
- https://github.com/ratpack/ratpack/commit/efb910d38a96494256f36675ef0e5061097dd77d Patch
- https://github.com/ratpack/ratpack/releases/tag/v1.7.5 Release Notes, Third Party Advisory
- https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j Third Party Advisory
- https://ratpack.io/versions/1.7.5 Vendor Advisory