CVE-2023-41834
Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. Users should upgrade to Apache Flink Stateful Functions version 3.3.0.
Timeline
ID reserved
By apache
- 18 days later
· 18 days later
Published
- 17 months later
· 17 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 2.3% · top 16% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.
Weakness
- CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') (opens in a new tab)All about CWE-113 and its CVEs
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (opens in a new tab)All about CWE-74 and its CVEs
Affected products
Apache Software Foundation · Apache Flink Stateful Functions
- affected 3.1.0 – ≤ 3.2.0
References (2)
- https://lists.apache.org/thread/cvxcsdyjqc3lysj1tz7s06zwm36zvwrm (opens in a new tab)vendor-advisoryx_transferred
- http://www.openwall.com/lists/oss-security/2023/09/19/3 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-41834)Record last updated .