JuliaWeb HTTP.jl up to 1.10.16 crlf injection

Summaryinfo

A vulnerability described as problematic has been identified in JuliaWeb HTTP.jl up to 1.10.16. The impacted element is an unknown function. Such manipulation leads to crlf injection. This vulnerability is uniquely identified as CVE-2025-52479. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in JuliaWeb HTTP.jl up to 1.10.16. It has been rated as problematic. Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a crlf injection vulnerability. Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. Impacted is integrity. CVE summarizes:

HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers (URIs). URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise escaped or protected, this can lead to a CRLF injection attack. Users of HTTP.jl should upgrade immediately to HTTP.jl v1.10.17, and users of URIs.jl should upgrade immediately to URIs.jl v1.6.0. The check for valid URIs is now in the URI.jl package, and the latest version of HTTP.jl incorporates that fix. As a workaround, manually validate any URIs before passing them on to functions in this package.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-52479 since 06/17/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.10.17 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19236). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• JuliaWeb

Name

• HTTP.jl

Version

• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4
• 1.10.5
• 1.10.6
• 1.10.7
• 1.10.8
• 1.10.9
• 1.10.10
• 1.10.11
• 1.10.12
• 1.10.13
• 1.10.14
• 1.10.15
• 1.10.16

Website

• Product: https://github.com/JuliaWeb/HTTP.jl/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion