{"id":"CVE-2026-34715","aliases":["GHSA-x2w3-23jr-hrpf"],"url":"https://o3.security/vulnerability/CVE-2026-34715","summary":"ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)","details":"ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\\r\\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content, leading to response splitting, cache poisoning, and possible cross-site scripting. Notably, ewe does validate CRLF in incoming request headers via validate_field_value() in the HTTP/1.1 parser — but provides no equivalent protection for outgoing response headers in the encoder. This issue has been patched in version 3.0.6.","published":"2026-04-02T17:57:00.501Z","modified":"2026-07-27T03:56:33.698727087Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Hex","name":"ewe","fixedVersion":"3.0.6"}],"fix":{"url":"https://github.com/vshakitskiy/ewe/commit/ce4ff214d32626a10fda9398dc94a2d720e17446","label":"vshakitskiy/ewe@ce4ff21"},"references":[{"type":"WEB","url":"https://github.com/vshakitskiy/ewe/releases/tag/v3.0.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34715.json"},{"type":"ADVISORY","url":"https://github.com/vshakitskiy/ewe/security/advisories/GHSA-x2w3-23jr-hrpf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34715"},{"type":"FIX","url":"https://github.com/vshakitskiy/ewe/commit/ce4ff214d32626a10fda9398dc94a2d720e17446"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-27T03:56:33.698727087Z"}}