JLSEC-2026-620 WebSocket reader data race in auto-PONG/CLOSE-echo handling in HTTP.jl

Description The WebSocket reader task processed incoming frames by calling wsonincomingdata! without holding ws.sendlock. That function is not a pure parser: its auto-PONG and CLOSE-echo paths push! onto the shared ws.codec.outgoingframes vector, while application send/ping/pong/close paths mutat...

Julia HTTP.jl 注入漏洞

Julia HTTP.jl is a Julia open source HTTP protocol for Julia. An injection vulnerability exists in Julia HTTP.jl versions prior to 1.10.19, which stems from illegal characters in unvalidated header names and values, and could lead to HTTP response splitting and header injection attacks...

PT-2025-41579

Name of the Vulnerable Software and Affected Versions HTTP.jl versions prior to 1.10.19 Description HTTP.jl, an HTTP client and server for the Julia programming language, did not properly validate header names and values, creating a risk of header injection and response splitting. This could lead...

CVE-2025-52479 HTTP.jl vulnerable to CR/LF Injection in URIs

HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers URIs. URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise...

CVE-2025-52479

The CVE-2025-52479 issue affects URIs.jl (before v1.6.0) and HTTP.jl (before v1.10.17), enabling construction of URIs containing CR/LF characters and potentially enabling CRLF injection. The vulnerability is described in OSV-JLSEC-2025-1 and corroborated by Red Hat and CVE sources: using vulnerab...

CVE-2025-52479 HTTP.jl vulnerable to CR/LF Injection in URIs

HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers URIs. URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise...

PT-2025-26849 · Uris.Jl +1 · Uris.Jl +1

Name of the Vulnerable Software and Affected Versions: HTTP.jl versions prior to 1.10.17 URIs.jl versions prior to 1.6.0 Description: The issue allows the construction of URIs containing CR/LF characters, which can lead to a CRLF injection attack if user input is not properly escaped or protected...