vshakitskiy ewe up to 3.0.4 set_header permissive list of allowed inputs

Summaryinfo

A vulnerability classified as problematic was found in vshakitskiy ewe up to 3.0.4. Affected is the function set_header. The manipulation results in permissive list of allowed inputs. This vulnerability is cataloged as CVE-2026-32881. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in vshakitskiy ewe up to 3.0.4. It has been classified as problematic. Affected is the function set_header. The manipulation with an unknown input leads to a permissive list of allowed inputs vulnerability. CWE is classifying the issue as CWE-183. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses. This is going to have an impact on integrity. CVE summarizes:

ewe is a Gleam web server. ewe is a Gleam web server. Versions 0.6.0 through 3.0.4 are vulnerable to authentication bypass or spoofed proxy-trust headers. Chunked transfer encoding trailer handling merges declared trailer fields into req.headers after body parsing, but the denylist only blocks 9 header names. A malicious client can exploit this by declaring these headers in the Trailer field and appending them after the final chunk, causing request.set_header to overwrite legitimate values (e.g., those set by a reverse proxy). This enables attackers to forge authentication credentials, hijack sessions, bypass IP-based rate limiting, or spoof proxy-trust headers in any downstream middleware that reads headers after ewe.read_body is called. This issue has been fixed in version 3.0.5.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-32881 since 03/16/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 3.0.5 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 07dcfd2135fc95f38c17a9d030de3d7efee1ee39 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• vshakitskiy

Name

• ewe

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4

License

• open-source

Website

• Product: https://github.com/vshakitskiy/ewe/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion