CVE-2026-39915
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-39915 is a high-severity HTTP Request/Response Splitting (CWE-113) vulnerability in Atlassian (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-15 (Information Output Filtering) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-64892
Vulnerability Data
TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into…
more
Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in their browser context, enabling session token theft and account credential modification.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.2V4.1.3V1.3.6V4.2.3
Mitigating Controls (NIST 800-53 r5) AI
Input validation stops unneutralized CR/LF characters from being accepted and later emitted in HTTP headers.
Output filtering can neutralize CRLF sequences before they reach HTTP response headers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input sanitization and header handling that prevent CRLF injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that reach HTTP header sanitization and therefore stop most (but not all) instances of CRLF injection from reaching production; a bounded remainder exists in implementation gaps, outsourced development without full assurance, and post-deployment changes.
A.8.26 explicitly lists resilience against SQL injections and input validation as application security requirements (items d and j), which directly addresses improper neutralization of special sequences like CRLF in HTTP headers; however, this is only one slice of a broad requirements-identification control whose coverage of other injection vectors, output handling, and non-web contexts leaves a bounded remainder.
A.8.27 mandates security-by-design principles (including input distrust, data validation/sanitization, secure architecture layers, and design reviews against attack patterns) that reach HTTP header sanitization and would stop most CRLF splitting if applied; this is a minority slice of the weakness because the clause is a general process that depends on specific implementation rigor and does not itself neutralize sequences in every code path or library.
Secure coding standards require neutralization of CRLF sequences before inclusion in HTTP headers.