CVE-2022-29631

HIGH

Jodd HTTP 5.0-6.2.0 - Server-Side Request Forgery via CRLF Injection in HttpRequest

Title source: llm

Description

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.

References (2)

Core 2

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/oblac/jodd/issues/787

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/oblac/jodd-http/issues/9

Scores

CVSS v3 7.5

EPSS 0.0094

EPSS Percentile 56.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-74

Status published

Products (2)

jodd/jodd_http 5.0 - 6.2.1

org.jodd/jodd-http 5.0.0 - 6.2.1Maven

Published Jun 06, 2022

Tracked Since Feb 18, 2026