CVE-2019-17513

HIGH

Ratpack < 1.7.5 - Injection

Title source: rule

Description

An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.

Exploits (1)

nomisec STUB

by epicosy · poc

https://github.com/epicosy/Ratpack-1

View Code ZIP pw:eip

References (5)

[Patch] https://github.com/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23ae

[Patch] https://github.com/ratpack/ratpack/commit/efb910d38a96494256f36675ef0e5061097dd77d

[Release Notes, Third Party Advisory] https://github.com/ratpack/ratpack/releases/tag/v1.7.5

[Third Party Advisory] https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j

[Vendor Advisory] https://ratpack.io/versions/1.7.5

Scores

CVSS v3 7.5

EPSS 0.0125

EPSS Percentile 79.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-74

Status published

Products (2)

io.ratpack/ratpack-core 0 - 1.7.5Maven

ratpack_project/ratpack < 1.7.5

Published Oct 18, 2019

Tracked Since Feb 18, 2026