# CVE-2025-4295: HotelRunner B2B HTTP response splitting via certificate validation failure

Source: https://junglewise.ai/threats/cve-2025-4295-hotelrunner-b2b-http-response-splitting-via-certificate-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-22. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-4295 · Severity: medium · CVSS 4.6 · Published 2025-07-22

HotelRunner B2B, a platform used for travel industry business-to-business operations, contains a security flaw in how it validates digital certificates. This vulnerability could allow an attacker to perform 'HTTP Response Splitting,' which can lead to the hijacking of user sessions or the delivery of malicious content to other users. Organizations using this service should ensure they are using the updated version released after June 4, 2025.

Technologies: [HotelRunner B2B](https://junglewise.ai/threats/technologies/b2b). Vendors: [HotelRunner](https://junglewise.ai/threats/vendors/hotelrunner).

## Quick answers

**Is CVE-2025-4295 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-4295 being exploited in the wild.

**How severe is CVE-2025-4295?** Medium severity, with a CVSS score of 4.6, published 22 July 2025.

**Which products and versions are affected?** HotelRunner B2B before 04.06.2025.

**Is there a fix for CVE-2025-4295?** A patch was published on 2025-06-04: Issue fixed in versions from this date onwards Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-4295 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-4295?** Check whether you run HotelRunner B2B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in HotelRunner B2B due to CWE-297 (Improper Validation of Certificate with Host Mismatch). This flaw allows for HTTP Response Splitting, a technique where an attacker can inject control characters into HTTP headers to split a single response into two. The attack vector is network-based and requires low privileges (PR:L) and user interaction (UI:R). By exploiting this, an attacker can potentially perform cross-site scripting (XSS), cache poisoning, or session hijacking. The issue is addressed in versions released on or after June 4, 2025.

## Affected products

- HotelRunner B2B before 04.06.2025

## Timeline

- 2025-07-22: advisory: NVD publication date
- 2025-06-04: patched: Issue fixed in versions from this date onwards

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0169](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0169)
- [https://www.usom.gov.tr/bildirim/tr-25-0169](https://www.usom.gov.tr/bildirim/tr-25-0169)

## Related threats

- [HotelRunner B2B open redirect and forceful browsing](https://junglewise.ai/threats/cve-2025-4296-hotelrunner-b2b-open-redirect-and-forceful-browsing)
- [HotelRunner B2B Cross-Site Scripting](https://junglewise.ai/threats/cve-2025-4294-hotelrunner-b2b-cross-site-scripting)