Read the docs
TI-2019-12552 Aliases CVE-2019-16771GHSA-24r8-fm9r-cpj2

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria

Priority LOW 31CWE-113Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement, cache poisoning, Cross-site scripting (XSS), and page hijacking.

Why it matters now

EPSS 0.00982 62nd percentileScored 2026-11-07
Fix Fixed Armeria (LINE): 0.97.0com.linecorp.armeria:armeria (Maven): 0.97.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LINE CorporationArmeria< 0.97.0 to before 0.97.00.97.0Patch availableCNA
—com.linecorp.armeria:armeria (Maven)0.50.0 to before 0.97.00.97.0Patch availableGHSA-24r8-fm9r-cpj2
  • Armeria VendorLINE Corporation Affected < 0.97.0 to before 0.97.0 Fixed in 0.97.0 Patch available CNA
  • com.linecorp.armeria:armeria (Maven) Vendor— Affected 0.50.0 to before 0.97.0 Fixed in 0.97.0 Patch available GHSA-24r8-fm9r-cpj2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*0.85.0 to before 0.97.0VulnerableLinecorp
  • cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:* Versions 0.85.0 to before 0.97.0 Vulnerable ·Linecorp

Remediation

  • Fix · CNA Armeria (LINE) Fixed in 0.97.0
  • Fix · GHSA-24r8-fm9r-cpj2 com.linecorp.armeria:armeria (Maven) Fixed in 0.97.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-16771
  2. 2026-10-03 Alias added: GHSA-24r8-fm9r-cpj2

References

Patch 1

Advisory 3

Other 1

  • TI-2024-01613 Improper authentication in LINE Corporation Armeria CVSS 3.1CRITICAL 9.1
  • TI-2023-05112 Improper certificate validation in LINE client for iOS CVSS 3.1CRITICAL 9.8
  • TI-2024-01060 Cross-site scripting in LINE Corporation Central Dogma CVSS 3.1CRITICAL 9.3
  • TI-2023-19873 Paths contain matrix variables bypass decorators CVSS 3.1HIGH 7.5
  • TI-2022-19973 LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat. CVSS 3.1HIGH 7.5
  • TI-2021-15992 Missing authorization in LINE Corporation Central Dogma CVSS 3.1HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences