CVE-2022-35256
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NodeJS | Node | 4.0 < 4.* | affected |
| NodeJS | Node | 5.0 < 5.* | affected |
| NodeJS | Node | 6.0 < 6.* | affected |
| NodeJS | Node | 7.0 < 7.* | affected |
| NodeJS | Node | 8.0 < 8.* | affected |
| NodeJS | Node | 9.0 < 9.* | affected |
| NodeJS | Node | 10.0 < 10.* | affected |
| NodeJS | Node | 11.0 < 11.* | affected |
| NodeJS | Node | 12.0 < 12.* | affected |
| NodeJS | Node | 13.0 < 13.* | affected |
| NodeJS | Node | 14.0 < 14.20.1 | affected |
| NodeJS | Node | 15.0 < 15.* | affected |
| NodeJS | Node | 16.0 < 16.17.1 | affected |
| NodeJS | Node | 17.0 < 17.* | affected |
| NodeJS | Node | 18.0 < 18.9.1 | affected |
Weaknesses
- CWE-444: HTTP Request Smuggling (CWE-444)
ADP Enrichment
CVE Program Container
Additional References
- https://hackerone.com/reports/1675191
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
- https://www.debian.org/security/2023/dsa-5326
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: yes
- Technical Impact: partial
References
- https://hackerone.com/reports/1675191
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
- https://www.debian.org/security/2023/dsa-5326
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.