CVE-2018-12537

CVE-2018-12537

Vendor The Eclipse Foundation
Product Eclipse Vert.x
Weakness CWE-93 · CRLF injection
Published August 14, 2018
Last update August 5, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.

Key dates

02Disclosure timeline

August 14, 2018 CVE published
August 5, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-49756 Multipart form-data header injection in Req via unescaped name/filename/content_type CVE-2023-49082 aiohttp's ClientSession is vulnerable to CRLF injection via method CVE-2026-12127 WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name CVE-2026-30227 MimeKit: CRLF Injection in Quoted Local-Part Enables SMTP Command Injection and Email Forgery CVE-2026-41230 Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()