What is the CVSS score of CVE-2026-38967?

CVE-2026-38967 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of CrowCpp Crow are affected by CVE-2026-38967?

CrowCpp Crow web framework through version 1.3.1 contains a critical HTTP response header injection vulnerability (CVE-2026-38967) that allows remote attackers to inject arbitrary content into…

How to fix or mitigate CVE-2026-38967?

Within 24 hours: Complete inventory of all applications using CrowCpp Crow v1.3.1 and earlier; identify which applications accept user input routed to HTTP response headers. Within 7 days: Implement mandatory input sanitization on all user input before header APIs (specifically stripping CR/LF characters per upstream PR #1167 guidance); deploy WAF rules to detect CR/LF injection attempts; patch or remove Crow dependency where feasible. Within 30 days: Monitor Crow project releases for security patch; test any patched Crow versions in non-production; develop upgrade plan and timeline for deployed applications.

CrowCpp Crow CVE-2026-38967

EUVD-2026-34020 CRITICAL

HTTP Response Splitting (CWE-113)

2026-06-02 mitre

GHSA-jjvh-j394-wqm7

Code Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 03, 2026 - 18:23 vuln.today

Analysis Generated

Jun 03, 2026 - 18:23 vuln.today

CVSS changed

Jun 03, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 02, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values.

AnalysisAI

HTTP response header injection in CrowCpp Crow through v1.3.1 allows remote attackers to inject arbitrary CR/LF sequences into response headers when application code passes unvalidated input to header-setting APIs. The flaw stems from the framework not stripping \r\n characters in header keys or values, enabling CRLF injection that can lead to response splitting, cache poisoning, or XSS depending on how the embedding application uses user input. No public exploit identified at time of analysis and EPSS is very low (0.02%), but the upstream fix in PR #1167 confirms the issue and provides a sanitization routine.

Technical ContextAI

Crow is a C++ header-only micro web framework (similar in design to Python's Flask) used to build HTTP servers and REST APIs in C++ applications. The root cause is CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers / HTTP Response Splitting): the framework's response and request header setters in include/crow/http_response.h and include/crow/http_request.h accepted arbitrary strings as header keys and values without filtering carriage-return (\r) or line-feed (\n) bytes. Because HTTP uses CRLF as a delimiter between headers and between headers and the body, an attacker-controlled value containing \r\n can terminate the current header early and inject additional headers or even a full second response. The upstream patch (PR #1167) introduces a sanitize_header_value() helper that strips \r and \n from both keys and values at the point where headers are set, and adds a demonstration example (helloworld_inject.cpp) showing the unsafe set_header("X-Custom", "safe\r\nInjected: yes") pattern.

RemediationAI

Upstream fix available via GitHub PR https://github.com/CrowCpp/Crow/pull/1167, which adds a sanitize_header_value() routine that strips \r and \n from header keys and values in both http_request.h and http_response.h; a released patched version is not independently confirmed in the provided data, so consumers should pull the post-PR-1167 commit from the CrowCpp/Crow repository and rebuild, or wait for a tagged release after v1.3.1. As a code-level workaround until the upgrade lands, audit every call site that invokes res.set_header(), res.add_header(), or request header setters with non-literal data and wrap the value with an equivalent strip of \r and \n before passing it in - note this requires source changes and a rebuild since Crow is header-only. At the perimeter, a reverse proxy or WAF (nginx, HAProxy, Envoy, ModSecurity) can be configured to drop or reject upstream responses containing bare CRLF inside header values, with the trade-off that strict header validation may break legitimate multi-line legacy headers and adds an extra hop. Avoid disabling Crow's header API as a mitigation since that would break normal application functionality.