CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax
Description
The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-644 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-jc3j-x6pg-4hmv | CVE-2026-48126 | HIGH |
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir |
2026-06-23 | |
| GHSA-gwhp-pf74-vj37 | CVE-2026-33805 | CRITICAL |
Fastify's connection header abuse enables stripping of proxy-added headers |
2026-06-09 | |
| GHSA-qw8v-34ww-6q9p | CVE-2025-70948 | MODERATE |
@perfood/couch-auth has a host header injection vulnerability |
2026-03-06 | |
| GHSA-ffpg-gm3h-4p5p | CVE-2025-63828 | MODERATE | - |
Backdrop CMS Host Header Injection vulnerability |
2025-11-19 |
| GHSA-vjrc-mh2v-45x6 | CVE-2025-64484 | HIGH |
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation |
2025-11-17 | |
| GHSA-xhfx-hgmf-v6vp | CVE-2021-21265 | LOW | - |
October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers |
2025-05-29 |
| GHSA-5c4w-8hhh-3c3h | CVE-2024-10006 | MODERATE |
Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability |
2025-01-10 | |
| GHSA-r969-783f-6jqr | CVE-2024-21499 | MODERATE |
Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security |
2024-02-20 | |
| GHSA-7m5c-fgwf-mwph | CVE-2023-34036 | MODERATE |
Spring HATEOAS vulnerable to Improper Neutralization of HTTP Headers for Scripting Syntax |
2023-07-19 | |
| GHSA-m2jh-fxw4-gphm | CVE-2021-41114 | MODERATE | - |
HTTP Host Header Injection |
2021-10-05 |