Read the docs
TI-2025-38120 Aliases CVE-2025-61689

HTTP.jl vulnerable to Header injection/Response splitting via header construction.

Priority LOW 38CWE-113Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header injection, leading to cache poisoning, XSS, session fixation, and more. This issue is fixed in HTTP.jl `v1.10.19`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Fix Fixed HTTP.jl (JuliaWeb): 1.10.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuliaWebHTTP.jlbefore 1.10.191.10.19Patch availableCNA
  • HTTP.jl VendorJuliaWeb Affected before 1.10.19 Fixed in 1.10.19 Patch available CNA

Remediation

  • Fix · CNA HTTP.jl (JuliaWeb) Fixed in 1.10.19

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-61689

References

Other 2

  • TI-2025-32606 HTTP.jl vulnerable to CR/LF Injection in URIs CVSS 4.0HIGH 7.7
  • TI-2025-32664 GitHub.jl lacks validation for user-provided fields CVSS 4.0MEDIUM 6.6
  • TI-2025-32061 GitForge.jl lacks validation for user provided fields CVSS 4.0MEDIUM 6.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences