IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-06-12 10:16

MODIFIED

2026-06-12 10:16

EPSS (Prob. Exploit)

0.38%

Top 68.5%

DATA SOURCES:

NVD 🔗 2026-06-12 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-10-29 OSV 🔗 2026-11-02

> DESCRIPTION

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'realm' parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-113

> CWE DETAILED DESCRIPTIONS

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers - The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

> GITHUB SECURITY ADVISORY

GHSA-xf62-wr5p-5p95 MODERATE

Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection

AFFECTED PACKAGES:

MAVEN / org.apache.cxf:cxf-rt-rs-security-oauth2

< 4.1.7

Fixed in: 4.1.7

MAVEN / org.apache.cxf:cxf-rt-rs-security-oauth2

>= 4.2.0, < 4.2.2

Fixed in: 4.2.2

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection

AFFECTED PACKAGES:

Unknown / Unknown

48 versions affected

ALIASES:

GHSA-xf62-wr5p-5p95

> HISTORIQUE DES MODIFICATIONS

Première apparition

12/06/2026 10:16

Source: NVD

📊 ENRICHISSEMENT 01/11/2026 06:59

CWE

Champ modifié: Description CWE

Ancienne valeur:

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') - The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.)...

Nouvelle valeur:

📊 ENRICHISSEMENT 01/07/2026 06:01

CWE