vshakitskiy ewe up to 3.0.5 Setting encoder.gleam validate_field_value response splitting

Summaryinfo

A vulnerability was found in vshakitskiy ewe up to 3.0.5. It has been classified as problematic. This affects the function validate_field_value of the file src/ewe/internal/encoder.gleam of the component Setting Handler. The manipulation leads to response splitting. This vulnerability is traded as CVE-2026-34715. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in vshakitskiy ewe up to 3.0.5. This issue affects the function validate_field_value of the file src/ewe/internal/encoder.gleam of the component Setting Handler. The manipulation with an unknown input leads to a response splitting vulnerability. Using CWE to declare the problem leads to CWE-113. The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. Impacted is integrity. The summary by CVE is:

ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content, leading to response splitting, cache poisoning, and possible cross-site scripting. Notably, ewe does validate CRLF in incoming request headers via validate_field_value() in the HTTP/1.1 parser — but provides no equivalent protection for outgoing response headers in the encoder. This issue has been patched in version 3.0.6.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-34715 since 03/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 3.0.6 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch ce4ff214d32626a10fda9398dc94a2d720e17446 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• vshakitskiy

Name

• ewe

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5

License

• open-source

Website

• Product: https://github.com/vshakitskiy/ewe/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion