Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Jooby Framework: Malicious HTTP Header Injection Possible

CVE-2020-7622 · published 6 years ago
Summary

The Jooby web framework may allow hackers to inject malicious code or hijack user sessions, especially if user input is not properly sanitized. To fix this, update to Jooby version 2.2.1 or take precautions to remove or sanitize CRLF characters from user input before passing it to HTTP headers.

What to do
  • Update jooby io.jooby:jooby-netty to version 2.2.1.
Affected software
Ecosystem VendorProductAffected versions
maven jooby io.jooby:jooby-netty < 2.2.1
Fix: upgrade to 2.2.1
– jooby jooby < 1.6.9
>= 2.0.0, < 2.2.1
cpe:2.3:a:jooby:jooby:*:*:*:*:*:*:*:*
Original advisory text
This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused ...
This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Timeline
Published6 Apr 2020
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-gv3v-92v6-m48j · GHSA
CVE-2020-7622 · NVD
CVE-2020-7622 · OSV
Track software like this
Free during beta