CVE-2026-34715

The record

ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content, leading to response splitting, cache poisoning, and possible cross-site scripting. Notably, ewe does validate CRLF in incoming request headers via validate_field_value() in the HTTP/1.1 parser — but provides no equivalent protection for outgoing response headers in the encoder. This issue has been patched in version 3.0.6.

Affected packages

Related vulnerabilities

• CVE-2026-2811 The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection… CWE-113
• CVE-2026-77341 cpp-httplib is a C++ header-only HTTP/HTTPS library. CWE-113
• CVE-2026-75419 go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. CWE-113
• CVE-2026-50576 ePA 3.x Integration implements the authorization workflow and writes Medical Information… CWE-113
• CVE-2026-54163 secure_headers manages application of security headers with many safe defaults. CWE-113
• CVE-2026-50188 Kirby is an open-source content management system. CWE-113
• CVE-2026-55766 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. CWE-113
• CVE-2026-50269 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-113