Executive brief
Crow is a C++ framework used for building web applications and services. A vulnerability in how it handles web response headers allows attackers to inject malicious data into the communication between the server and the user. This could be used to perform session hijacking, bypass security controls, or conduct cache poisoning attacks, potentially compromising user data or application integrity.
Technical details
CrowCpp Crow through v1.3.1 is vulnerable to HTTP response header injection (CWE-113). The vulnerability exists in the `set_header` and `add_header` methods of the `crow::response` and `crow::request` classes, which fail to sanitize Carriage Return (\r) and Line Feed (\n) characters. An attacker can exploit this by providing specially crafted input that is reflected into a response header, allowing them to inject arbitrary headers or split the HTTP response. This can lead to session hijacking via cookie injection, Cross-Site Scripting (XSS), or cache poisoning. The issue was addressed in March 2026 by implementing a `sanitize_header_value` utility that strips CR/LF characters.
Affected products
- CrowCpp Crow through 1.3.1
Timeline
- 2026-03-19: disclosed: Issue reported on GitHub
- 2026-03-27: patched: Fix merged into master branch
- 2026-06-02: advisory: CVE published to NVD