Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This…

Description

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.

Scores

EPSS (exploitation in 30 days)

0.56% · top 53% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') (opens in a new tab)All about CWE-93 and its CVEs
• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (opens in a new tab)All about CWE-74 and its CVEs

Affected products

• Swift Project · Async HTTP Client

  • affected unspecified – ≤ 1.13.1

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• SwiftURLgithub.com/swift-server/async-http-clientGHSA-v3r5-pjpm-mwgq (opens in a new tab)

References (1)

• https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-v3r5-pjpm-mwgq (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-0040](https://trackcve.app/badge/CVE-2023-0040.svg)](https://trackcve.app/cve/CVE-2023-0040)

Record last updated 3 Apr 2025, 19:28 UTC.