CVE-2026-38967: CrowCpp Crow through v1

Synopsis

Response header injection in CrowCpp Crow (through v1.3.1) allows a remote, unauthenticated attacker to inject arbitrary HTTP response headers by supplying unvalidated values that are reflected back to clients. The vulnerability is reachable over the network with no credentials required and no victim interaction needed. Successful exploitation enables reading sensitive data, tampering with responses, and disrupting service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Crow HTTP service over the network; no local or physical access is needed.

• AuthenticationNot required

  No credentials or session token of any kind are required to send a malicious request.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; the injection can be triggered by a direct request to the server.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or other environmental factors.

Blast Radius

• An attacker injects arbitrary headers into HTTP responses, enabling cache-poisoning attacks that persist malicious content for other users.
• Injected Set-Cookie or Location headers allow session fixation or open redirects, exposing stored session tokens and user credentials.
• Attacker-controlled response headers can be used to disable security policies (such as Content-Security-Policy or HSTS), opening the door to cross-site scripting and downgrade attacks.
• Malformed header sequences can cause HTTP parsing errors in downstream proxies or clients, crashing or destabilizing dependent services.