{“lastseen”:”2025-12-30T10:25:50″,”description”:”================================================================================\\nVULNERABILITY REPORT: HTTP\/2 and HTTP\/3 Header Injection in curl\\n================================================================================\\n\\nVULNERABILITY TYPE: Response Header Injection \/ HTTP Response Splitting\\nSEVERITY: HIGH (CVSS 7.5+)\\nAFFECTED VERSIONS: curl latest (as of 2025-12-29)\\nSTATUS: 0-DAY (UNPATCHED in http2.c, curl_ngtcp2.c, curl_osslq.c)\\n\\n================================================================================\\nEXECUTIVE SUMMARY\\n================================================================================\\n\\nA critical header injection vulnerability exists in curl’s HTTP\/2 and HTTP\/3\\nprotocol handlers. When receiving HTTP\/2 or HTTP\/3 headers from a malicious\\nserver, curl directly incorporates header names and values into HTTP\/1-style\\nheader strings WITHOUT validating for CR (\\\\r), LF (\\\\n), or null (\\\\0) bytes.\\n\\nThis vulnerability was PARTIALLY FIXED on 2025-12-27 in commit 6842d4e for\\nthe QUICHE HTTP\/3 backend ONLY. Three other backends remain vulnerable:\\n\\n 1. lib\/http2.c – HTTP\/2 via nghttp2 (VULNERABLE)\\n 2. lib\/vquic\/curl_ngtcp2.c – HTTP\/3 via ngtcp2 (VULNERABLE)\\n 3. lib\/vquic\/curl_osslq.c – HTTP\/3 via OpenSSL QUIC (VULNERABLE)\\n\\n================================================================================\\nTECHNICAL DETAILS\\n================================================================================\\n\\nVULNERABLE CODE PATTERN:\\n\\n1. HTTP\/2 (lib\/http2.c, lines 1705-1717):\\n\\n \/* convert to an HTTP1-style header *\/\\n curlx_dyn_reset(\\u0026ctx-\\u003escratch);\\n result = curlx_dyn_addn(\\u0026ctx-\\u003escratch, (const char *)name, namelen); \/\/ UNVALIDATED\\n if(!result)\\n result = curlx_dyn_addn(\\u0026ctx-\\u003escratch, STRCONST(\\”: \\”));\\n if(!result)\\n result = curlx_dyn_addn(\\u0026ctx-\\u003escratch, (const char *)value, valuelen); \/\/ UNVALIDATED\\n if(!result)\\n result = curlx_dyn_addn(\\u0026ctx-\\u003escratch, STRCONST(\\”\\\\r\\\\n\\”));\\n\\n2. HTTP\/3 via ngtcp2 (lib\/vquic\/curl_ngtcp2.c, lines 1220-1229):\\n\\n curlx_dyn_reset(\\u0026ctx-\\u003escratch);\\n result = curlx_dyn_addn(\\u0026ctx-\\u003escratch,\\n (const char *)h3name.base, h3name.len); \/\/ UNVALIDATED\\n if(!result)\\n result = curlx_dyn_addn(\\u0026ctx-\\u003escratch, STRCONST(\\”: \\”));\\n if(!result)\\n result = curlx_dyn_addn(\\u0026ctx-\\u003escratch,\\n (const char *)h3val.base, h3val.len); \/\/ UNVALIDATED\\n if(!result)\\n result = curlx_dyn_addn(\\u0026ctx-\\u003escratch, STRCONST(\\”\\\\r\\\\n\\”));\\n\\n3. HTTP\/3 via OpenSSL QUIC (lib\/vquic\/curl_osslq.c, lines 873-887):\\n\\n result = write_resp_raw(cf, data, h3name.base, h3name.len, FALSE); \/\/ UNVALIDATED\\n \/\/ …\\n result = write_resp_raw(cf, data, h3val.base, h3val.len, FALSE); \/\/ UNVALIDATED\\n\\nPATCHED CODE (curl_quiche.c, commit 6842d4e):\\n\\n static bool is_valid_h3_header(const uint8_t *hdr, size_t hlen)\\n {\\n while(hlen–) {\\n switch(*hdr++) {\\n case ‘\\\\n’:\\n case ‘\\\\r’:\\n case ‘\\\\0’:\\n return FALSE;\\n }\\n }\\n return TRUE;\\n }\\n\\n \/\/ Now validates before using:\\n if(is_valid_h3_header(value, value_len) \\u0026\\u0026\\n is_valid_h3_header(name, name_len)) {\\n \/\/ … process header\\n }\\n\\n================================================================================\\nATTACK SCENARIO\\n================================================================================\\n\\n1. CLIENT connects to MALICIOUS SERVER using HTTP\/2 or HTTP\/3\\n\\n2. MALICIOUS SERVER sends an HTTP\/2 or HTTP\/3 response with crafted headers:\\n \\n Header Name: \\”X-Injected\\\\r\\\\nSet-Cookie: session=evil\\”\\n Header Value: \\”foo\\”\\n \\n OR\\n \\n Header Name: \\”X-Normal\\”\\n Header Value: \\”foo\\\\r\\\\nX-Injected-Header: malicious-value\\”\\n\\n3. CURL converts to HTTP\/1-style headers WITHOUT validation:\\n\\n Result: \\”X-Injected\\\\r\\\\nSet-Cookie: session=evil: foo\\\\r\\\\n\\”\\n\\n4. APPLICATION processing these headers may:\\n – Accept injected cookies (cookie injection)\\n – Process injected headers as legitimate\\n – Experience cache poisoning if used as a proxy\/CDN\\n – Have security headers bypassed\\n\\n================================================================================\\nEXPLOITATION CONDITIONS\\n================================================================================\\n\\nREQUIREMENTS:\\n- Victim must connect to attacker-controlled server using HTTP\/2 or HTTP\/3\\n- Application must process curl’s response headers\\n- Attacker controls the server-side HTTP\/2 or HTTP\/3 implementation\\n\\nATTACK VECTORS:\\n1. Man-in-the-Middle with modified HTTP\/2\/3 responses\\n2. Compromised server sending malicious headers\\n3. Malicious redirect to attacker’s HTTP\/2\/3 server\\n\\n================================================================================\\nIMPACT ASSESSMENT\\n================================================================================\\n\\n- Cookie Injection: Attacker can set arbitrary cookies\\n- Cache Poisoning: Stored responses may contain injected headers\\n- Security Header Bypass: CSP, HSTS, etc. can be manipulated\\n- Response Splitting: Classic HTTP response splitting attacks\\n- Information Disclosure: Via crafted headers in error messages\\n\\nNote: HTTP\/2 has ADDITIONAL risk factor:\\n – Line 460: nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation(o, 1);\\n – This DISABLES RFC 9113 header validation in nghttp2!\\n\\n================================================================================\\nRECOMMENDED FIX\\n================================================================================\\n\\nApply the same validation added to curl_quiche.c (commit 6842d4e) to:\\n\\n1. lib\/http2.c – Add is_valid_header() check before line 1705\\n2. lib\/vquic\/curl_ngtcp2.c – Add is_valid_h3_header() check before line 1220\\n3. lib\/vquic\/curl_osslq.c – Add is_valid_h3_header() check before line 873\\n\\nSUGGESTED PATCH:\\n\\n\/\/ Add to each file:\\nstatic bool is_valid_header(const uint8_t *hdr, size_t hlen)\\n{\\n while(hlen–) {\\n switch(*hdr++) {\\n case ‘\\\\n’:\\n case ‘\\\\r’:\\n case ‘\\\\0’:\\n return FALSE;\\n }\\n }\\n return TRUE;\\n}\\n\\n\/\/ Then validate before processing:\\nif(!is_valid_header(name, namelen) || !is_valid_header(value, valuelen)) {\\n \/\/ Return error or skip header\\n return NGHTTP2_ERR_CALLBACK_FAILURE; \/\/ For HTTP\/2\\n}\\n\\n================================================================================\\nCVE ASSIGNMENT\\n================================================================================\\n\\nThis vulnerability should be assigned a CVE identifier.\\n\\nRelated: Commit 6842d4e (partial fix for QUICHE only) mentions issue #20101\\n\\n================================================================================\\nTIMELINE\\n================================================================================\\n\\n2025-12-27: Partial fix committed for QUICHE backend (commit 6842d4e)\\n2025-12-29: Discovery of same vulnerability in HTTP\/2 and other HTTP\/3 backends\\n2025-12-29: This report generated\\n\\n================================================================================\\nRESEARCHER\\n================================================================================\\n\\nIdentified via static code analysis of curl source repository.\\n\\n## Impact\\n\\n## Summary:”,”published”:”2025-12-29T23:21:14″,”modified”:”2025-12-30T09:56:51″,”type”:”hackerone”,”title”:”curl: HTTP\/2 and HTTP\/3 Header Injection in curl”,”source”:””,”references”:””,”id”:”H1:3481849″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3481849″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-30T10:25:50″,”description”:”================================================================================\\nVULNERABILITY REPORT: HTTP\/2 and HTTP\/3 Header Injection in curl\\n================================================================================\\n\\nVULNERABILITY TYPE: Response Header Injection \/ HTTP Response Splitting\\nSEVERITY: HIGH (CVSS 7.5+)\\nAFFECTED VERSIONS: curl latest (as of…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-33249","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n