TI-2023-11366 CVE-2023-26142 · GHSA-3r2p-c9r5-pw6w
HTTP response splitting in Crow
Priority HIGH 68
All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values.
CrowCpp
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
CrowCpp records in CISA KEVNo CrowCpp vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
TI-2022-15735 CVE-2022-34970 · GHSA-h8v6-grj2-pfx5
Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in…
Priority MEDIUM 49
Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h.
TI-2022-18200 CVE-2022-38667 · GHSA-g8qv-x989-399f
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and…
Priority MEDIUM 48
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used.
TI-2026-80080 CVE-2026-116011 · GHSA-88wj-6c62-8f7x
Uncontrolled recursion in Crow JSON parsing crashes server remotely
Priority MEDIUM 45
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON.
TI-2022-18201 CVE-2022-38668 · GHSA-5948-4f22-j6wp
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive…
Priority LOW 36
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB.
TI-2021-06154 CVE-2021-23514 · GHSA-m754-q244-3crw
Path traversal in Crow
Priority LOW 36
This affects the package Crow before 0.3+4.
TI-2021-06197 CVE-2021-23824 · GHSA-phvc-ghwf-mr3q
Content Injection
Priority LOW 31
This affects the package Crow before 0.3+4.