Medium severity6.1NVD Advisory· Published Aug 8, 2016· Updated May 6, 2026

CVE-2016-5331

Description

CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Affected products

VMware/Esxi
cpe:2.3:o:vmware:esxi:6.0:*:*:*:*:*:*:*
VMware/Vcenter Server
cpe:2.3:a:vmware:vcenter_server:*:update_1b:*:*:*:*:*:*
Range: <=6.0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.vmware.com/security/advisories/VMSA-2016-0010.htmlnvdMitigationPatchVendor Advisory
packetstormsecurity.com/files/138211/VMware-vSphere-Hypervisor-ESXi-HTTP-Response-Injection.htmlnvd
seclists.org/fulldisclosure/2016/Aug/38nvd
www.securityfocus.com/archive/1/539128/100/0/threadednvd
www.securityfocus.com/bid/92324nvd
www.securitytracker.com/id/1036543nvd
www.securitytracker.com/id/1036544nvd
www.securitytracker.com/id/1036545nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000