VULNERABILITY INTELLIGENCE

CVE-2019-17513

CVSS score7.5 HIGH
EPSS probability2.15%
CISA KEVNot currently listed
Published2019-10-18
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.

Weakness classification

  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Primary references