Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)

KRITISCH 9.8CVE-2020-7622 · GHSA-gv3v-92v6-m48j · SNYK-JAVA-IOJOOBY-564249 · Published 06/04/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-7622 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in io.jooby:jooby-netty, jooby (jooby).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.6%, höher als bei 75.9% aller Schwachstellen.
Abhilfe: auf 2.2.1, 1.6.9 oder neuer aktualisieren.

Package	Affected versions	Patched versions
io.jooby:jooby-netty Maven	`< 2.2.1`	`2.2.1`
jooby jooby	`≥ 2.0.0, < 2.2.1< 1.6.9`	`2.2.11.6.9`

Description

Impact

Cross Site Scripting
Cache Poisoning
Page Hijacking

Patches

This was fixed in version 2.2.1.

Workarounds

If you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters.

References

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

I've been poking at libraries to see if they are vulnerable to HTTP Response Splitting and Jooby is my third case of finding this vulnerability.

Root Cause

This roots cause back to this line in the Jooby codebase:

https://github.com/jooby-project/jooby/blob/93cfc80aa20c188f71a442ea7a1827da380e1c27/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java#L102

The DefaultHttpHeaders takes a parameter validate which, when true (as it is for the no-arg constructor) validates that the header isn't being abused to do HTTP Response Splitting.

Reported By

This vulnerability was reported by @JLLeitschuh (Twitter)

For more information

If you have any questions or comments about this advisory:

Open an issue in jooby-project/jooby

NVD description

This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.

References

jooby-project/jooby security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-7622 · ADVISORY
jooby-project/jooby commit b66e334 · WEB
snyk.io/vuln/SNYK-JAVA-IOJOOBY-564249 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

io.jooby:jooby-netty

Maven

< 2.2.1

2.2.1

jooby

≥ 2.0.0, < 2.2.1< 1.6.9

2.2.11.6.9

Description

Impact

Cross Site Scripting
Cache Poisoning
Page Hijacking

Patches

This was fixed in version 2.2.1.

Workarounds

If you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters.

References

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

I've been poking at libraries to see if they are vulnerable to HTTP Response Splitting and Jooby is my third case of finding this vulnerability.

Root Cause

This roots cause back to this line in the Jooby codebase:

https://github.com/jooby-project/jooby/blob/93cfc80aa20c188f71a442ea7a1827da380e1c27/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java#L102

The DefaultHttpHeaders takes a parameter validate which, when true (as it is for the no-arg constructor) validates that the header isn't being abused to do HTTP Response Splitting.

Reported By

This vulnerability was reported by @JLLeitschuh (Twitter)

For more information

If you have any questions or comments about this advisory:

Open an issue in jooby-project/jooby

NVD description