{"id":"CVE-2023-41834","state":"PUBLISHED","title":"Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences","description":"Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. \n\nUsers should upgrade to Apache Flink Stateful Functions version 3.3.0.","publishedAt":"2023-09-19T12:34:16.970Z","updatedAt":"2025-02-13T17:09:03.658Z","severity":null,"assigner":"apache","products":["Apache Software Foundation Apache Flink Stateful Functions"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Flink Stateful Functions","defaultStatus":"unaffected","versions":[{"version":"3.1.0","status":"affected","lessThanOrEqual":"3.2.0","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/cvxcsdyjqc3lysj1tz7s06zwm36zvwrm","http://www.openwall.com/lists/oss-security/2023/09/19/3"],"weaknesses":["CWE-113","CWE-74"],"ingestedAt":"2026-10-29T20:06:17.512Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/41xxx/CVE-2023-41834.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-41834","state":"PUBLISHED","datePublished":"2023-09-19T12:34:16.970Z","dateUpdated":"2025-02-13T17:09:03.658Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2023-09-01T20:38:56.287Z"},"containers":{"cna":{"title":"Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences","descriptions":[{"lang":"en","value":"Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. \n\nUsers should upgrade to Apache Flink Stateful Functions version 3.3.0."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Flink Stateful Functions","defaultStatus":"unaffected","versions":[{"version":"3.1.0","status":"affected","lessThanOrEqual":"3.2.0","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/cvxcsdyjqc3lysj1tz7s06zwm36zvwrm","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/09/19/3"}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-113","description":"CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-74","description":"CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2023-09-19T12:35:06.999Z"},"credits":[{"lang":"en","type":"finder","value":"Andrea Cosentino"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/cvxcsdyjqc3lysj1tz7s06zwm36zvwrm","tags":["vendor-advisory","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2023/09/19/3","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T19:09:49.376Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-25T14:19:23.421042Z","id":"CVE-2023-41834","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-25T14:19:29.675Z"}}]}}}