CVE-2026-38967 in Crow

Summary

by MITRE • 06/03/2026

CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsible: MITRE
• Reservation: 04/06/2026
• Disclosure: 06/03/2026
• Moderation: accepted
• Entry: VDB-368083
• CPE: ready
• CWE: CWE-74 (confirmed)
• CVSS: 7.3 (VulDB)
• EPSS: 0.00018
• KEV: no
• Activities: medium

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-38967
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-38967
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-38967/