Vulnerability · Published Oct 10, 2025 · Assigned by GitHub_M

CVE-2025-61689HTTP.jl vulnerable to Header injection/Response splitting via header construction.

High 8.7

In plain English

A high-severity security flaw in HTTP.jl from JuliaWeb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 72.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header injection, leading to cache poisoning, XSS, session fixation, and more. This issue is fixed in HTTP.jl `v1.10.19`.

Affected products (as reported)

Vendor	Product	Versions
JuliaWeb	HTTP.jl	< 1.10.19

Weakness: CWE-113 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P

References

https://github.com/JuliaWeb/HTTP.jl/security/advisories/GHSA-h3x8-ppwj-6vcj x_refsource_CONFIRM
https://github.com/JuliaWeb/HTTP.jl/releases/tag/v1.10.19 x_refsource_MISC