6 matches found
morgan: morgan: Log forgery due to unneutralized control characters
A flaw was found in the morgan HTTP request logging middleware. The :remote-user token writes the Basic auth username to access logs without neutralizing CR/LF control characters. An unauthenticated remote attacker can inject forged log lines via a crafted Authorization header, breaking...
EUVD-2026-34067
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user...
CVE-2026-5078
A flaw was found in the morgan HTTP request logging middleware. The :remote-user token writes the Basic auth username to access logs without neutralizing CR/LF control characters. An unauthenticated remote attacker can inject forged log lines via a crafted Authorization header, breaking...
CVE-2026-5078 morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF...
CVE-2026-5078 morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF...