CVE-2026-1527

Description

ImpactWhen an application passes user-controlled input to theupgradeoption ofclient.request(), an attacker can inject CRLF sequences (rn) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)The vulnerability exists because undici writes theupgradevalue directly to the socket without validating for invalid header characters:// lib/dispatcher/client-h1.js:1121if (upgrade) { header += connection: upgradernupgrade: ${upgrade}rn}

Risk Information

Base Score

4.6

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.009

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in IBM App Connect Enterprise 13.0.6.2	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234