CVE-2026-38967

CriticalCVSS 9.8

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Vulnerability in CrowCpp Crow through v1.3.1 HTTP allows response header injection via unvalidated response header values.

An attacker can manipulate HTTP response headers, potentially leading to cache poisoning, session fixation, or cross-site scripting (XSS) attacks.

Update CrowCpp Crow to a version later than v1.3.1 or implement proper header validation.

Original NVD description (English source)

CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values.