CVE-2023-0040

🗓️ 18 Jan 2023 00:00:00Reported by SwiftType

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to CRLF injection due to insufficient validation of HTTP header field values

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2023-0040	18 Jan 202322:21	–	circl
CNNVD	Async 注入漏洞	18 Jan 202300:00	–	cnnvd
Cvelist	CVE-2023-0040	18 Jan 202300:00	–	cvelist
EUVD	EUVD-2023-1887	3 Oct 202520:07	–	euvd
Github Security Blog	Async HTTP Client has CRLF Injection vulnerability in HTTP request headers	7 Jun 202315:52	–	github
GitLab Advisory Database	Async HTTP Client has CRLF Injection vulnerability in HTTP request headers	7 Jun 202300:00	–	gitlab
NVD	CVE-2023-0040	18 Jan 202319:15	–	nvd
OSV	GHSA-V3R5-PJPM-MWGQ Async HTTP Client has CRLF Injection vulnerability in HTTP request headers	7 Jun 202315:52	–	osv
Prion	Crlf injection	18 Jan 202319:15	–	prion
Positive Technologies	PT-2023-15966 · Unknown · Async Http Client	18 Jan 202300:00	–	ptsecurity

NVD

Node

asynchttpclient_project async-http-clientRange<1.4.1

asynchttpclient_project async-http-clientRange1.5.0–1.9.1

asynchttpclient_project async-http-clientRange1.10.0–1.12.1

asynchttpclient_project async-http-clientRange1.13.0–1.13.2

[
  {
    "vendor": "Swift Project",
    "product": "Async HTTP Client",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "1.13.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq

03 Apr 2025 20:15Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.5

EPSS0.00356

SSVC