Unrated severityNVD Advisory· Published Sep 19, 2023· Updated Feb 13, 2025
Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences
CVE-2023-41834
Description
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser.
Users should upgrade to Apache Flink Stateful Functions version 3.3.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2>=3.1.0, <=3.2.0+ 1 more
- (no CPE)range: >=3.1.0, <=3.2.0
- (no CPE)range: 3.1.0
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.