CVE-2025-55271: hcl aftermarket dpc HTTP Request/Response Splitting

Vulnerability summary

CVE-2025-55271 is a high (CVSS 8.8) HTTP Request/Response Splitting vulnerability in hcl aftermarket dpc. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.3% of scored vulnerabilities.

Timeline

1. 26-03-2026
   PublishedVulnerability first disclosed.
2. 26-03-2026
   Last modifiedVulnerability information updated.

Description

HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker may be able to execute arbitrary commands or inject harmful content into the response..

• CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.