Vulnerability · Published Sep 19, 2023 · Assigned by apache

CVE-2023-41834Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences

Medium 6.1

In plain English

A medium-severity injection in Apache Flink Stateful Functions from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)2.3%top 16.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. Users should upgrade to Apache Flink Stateful Functions version 3.3.0.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Flink Stateful Functions	3.1.0 – through 3.2.0

Weakness: CWE-113, CWE-74

In plain English

Official description

Affected products (as reported)

References