Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2023-41834

Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. Users should upgrade to Apache Flink Stateful Functions version 3.3.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Flink Stateful Functions

Default version status: unaffected

  • 3.1.0 to ≤ 3.2.0affected

References