CVE-2023-26137
Drogon
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NSummary
CVE-2023-26137 is a high-severity HTTP Request/Response Splitting (CWE-113) vulnerability in Drogon Drogon. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-29978
Vulnerability Data
All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n (carriage return line feeds) characters to…
more
end the HTTP response headers and inject malicious content.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.2V4.1.3V4.2.4V1.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Configuration management can enforce uniform HTTP parsing rules across intermediaries, directly mitigating inconsistent interpretation.
Secure SDLC practices directly require input sanitization and header handling that prevent CRLF injection.
Network monitoring can detect smuggling attempts via anomalous HTTP traffic or logs, while eliminating the inconsistency directly aids detection of such events.
Network protections can enforce consistent HTTP proxy/firewall behavior to block smuggling, and removing the weakness helps prevent unauthorized access via request smuggling.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect CRLF injection flaws before deployment.
Network security controls can enforce consistent HTTP parsing and proxy behavior that mitigates request smuggling.
Secure network services include hardening proxies and gateways against inconsistent HTTP interpretation.
Secure development lifecycle mandates input validation and output encoding that directly prevents CRLF injection into HTTP headers.
Application security requirements explicitly call for controls against injection flaws including HTTP header manipulation.
Secure architecture principles reduce the likelihood of header-splitting vulnerabilities through proper component isolation.