CVE-2023-41834

MEDIUM

Apache Flink Stateful Functions 3.1.0-3.2.0 - HTTP Response Splitting via CRLF Injection

Title source: llm

Description

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. Users should upgrade to Apache Flink Stateful Functions version 3.3.0.

References (2)

Core 2

Core References

Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/09/19/3

Mailing List, Vendor Advisory vendor-advisory

https://lists.apache.org/thread/cvxcsdyjqc3lysj1tz7s06zwm36zvwrm

Scores

CVSS v3 6.1

EPSS 0.0161

EPSS Percentile 72.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-113 CWE-74

Status published

Products (1)

apache/flink_stateful_functions 3.1.0 - 3.2.0

Published Sep 19, 2023

Tracked Since Feb 18, 2026