CVE-2025-36227
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Mar 10, 2026
CISA due date
—
The record
IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-67179 Genkit does not properly validate host request headers. CWE-644
- CVE-2026-66778 SAP Approuter does not sufficiently sanitize certain request headers before forwarding… CWE-644
- CVE-2026-72574 A host header injection vulnerability in picocms/Pico through 2.1.4 allows an… CWE-644
- CVE-2026-0516 A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS… CWE-644
- CVE-2026-48061 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. CWE-644
- CVE-2026-21762 HCL DevOps Loop is affected by missing HTTP security headers. CWE-644
- CVE-2026-54477 The admin panel lacks standard security headers, enabling clickjacking and cross-site… CWE-644
- CVE-2024-51454 IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through… CWE-644