Description

This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.

Remediation

References

https://github.com/jooby-project/jooby/commit/b66e3342cf95205324023cfdf2cb5811e8a6dcf4

https://github.com/jooby-project/jooby/security/advisories/GHSA-gv3v-92v6-m48j

https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-564249

Related Vulnerabilities

CVE-2021-32820 Vulnerability in npm package express-handlebars

CVE-2019-10761 Vulnerability in npm package vm2

CVE-2022-21164 Vulnerability in npm package node-lmdb

CVE-2020-7597 Vulnerability in npm package codecov

CVE-2022-25869 Vulnerability in npm package angular

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit NVD-CWE-Other