CVE-2026-50576

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

CVE-2026-50576

CVE-2026-50576 is a CRLF header injection vulnerability in ePA 3.x Integration , a component of Germany's electronic patient record system. The build_inner_header function in app/vau/VAUProtokoll.py interpolates user-controlled values (uri, host, accept_type, content_type, content_length, USER_AG...