CVE-2022-35507

Deeper analysis

CVE-2022-35507 is a response-header CRLF injection vulnerability present in the web interface of Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG). The flaw resides in the pve-http-server component and permits injection of carriage-return line-feed sequences, most notably via %0d, which Chromium-based browsers accept when processing server responses. This leads to the server setting cookies that exceed its own length expectations, producing a client-side denial of service.

A remote attacker can trigger the issue without authentication by sending a crafted request that causes the victim’s browser to receive and store an oversized cookie. The attack requires user interaction (the victim must visit a malicious or compromised page) and results in loss of availability for the affected browser session while leaving confidentiality and server integrity intact.

The issue is resolved in pve-http-server 4.1-3; the corresponding commit on the Proxmox git repository updates header handling to prevent CRLF injection. Security advisories and the vendor patch therefore direct administrators to upgrade the package on all exposed PVE and PMG instances.

The EPSS score rose from a low baseline to a recorded peak of 0.4175, indicating that exploitation interest emerged after public disclosure.