Unrated severityNVD Advisory· Published Dec 4, 2022· Updated Apr 24, 2025

CVE-2022-35507

Description

A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.

Affected products

Proxmox/Virtual Environmentdescription
Proxmox/Mail Gatewayllm-fuzzy
Terraform/Proxmox Virtual Environment Providerllm-fuzzy
Proxmox/Pve HTTP Serverllm-fuzzy
Range: <4.1-3

Patches

Vulnerability mechanics

References

git.proxmox.commitre
starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000