Low severity3.7NVD Advisory· Published Jan 20, 2016· Updated Jun 17, 2026
CVE-2016-1900
CVE-2016-1900
Description
CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via newline characters in a filename.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
8- www.openwall.com/lists/oss-security/2016/01/14/3nvdPatch
- git.zx2c4.com/cgit/commit/nvd
- lists.fedoraproject.org/pipermail/package-announce/2016-January/176167.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2016-January/176198.htmlnvd
- lists.opensuse.org/opensuse-updates/2016-01/msg00067.htmlnvd
- lists.opensuse.org/opensuse-updates/2016-01/msg00084.htmlnvd
- www.debian.org/security/2016/dsa-3545nvd
- www.openwall.com/lists/oss-security/2016/01/14/6nvd
News mentions
0No linked articles in our index yet.