PT-2025-27254

CVE-2025-53094

Published

2025-06-27

Updated

2025-06-28

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: ESPAsyncWebServer versions up to and including 3.7.8

Description: A CRLF injection vulnerability exists in the construction and output of HTTP headers within AsyncWebHeader.cpp. Unsanitized input allows attackers to inject CR (r) or LF ( ) characters into header names or values, leading to arbitrary header or response manipulation. This can enable a wide range of attacks.

Recommendations: For versions up to and including 3.7.8, apply the fix available at pull request 211, which is expected to be part of version 3.7.9. As a temporary workaround, consider restricting the input to AsyncWebHeader.cpp to prevent CR and LF character injections until the patch is applied.

Exploitability

Exploit

Fix

Researchers

Jlleitschuh

Vendors

Affected products

Weakness enumeration

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\'HTTP Request/Response Splitting\')

CWE-93: Improper Neutralization of CRLF Sequences (\'CRLF Injection\')

Related identifiers

CVE-2025-53094