Low severity3.7NVD Advisory· Published Jan 20, 2016· Updated Jun 17, 2026
CVE-2016-1899
CVE-2016-1899
Description
CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit.c.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
8- www.openwall.com/lists/oss-security/2016/01/14/3nvdPatch
- git.zx2c4.com/cgit/commit/nvd
- lists.fedoraproject.org/pipermail/package-announce/2016-January/176167.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2016-January/176198.htmlnvd
- lists.opensuse.org/opensuse-updates/2016-01/msg00067.htmlnvd
- lists.opensuse.org/opensuse-updates/2016-01/msg00084.htmlnvd
- www.debian.org/security/2016/dsa-3545nvd
- www.openwall.com/lists/oss-security/2016/01/14/6nvd
News mentions
0No linked articles in our index yet.