CVE-2025-7339

Aliases:GHSA-76c9-3jph-rj3qDEBIAN-CVE-2025-7339CGA-2558-cm37-538vCGA-2j7p-mxr2-g7grCGA-34cv-6c5h-x5p5CGA-3h45-rj27-cp62CGA-42pm-x4h5-3xpvCGA-45jr-w57p-q9xhCGA-46m2-cc3x-2v97CGA-46pj-q9h3-8mf3CGA-48w6-xjjv-ff2jCGA-4wv3-2gx5-h24xCGA-5jc9-m5hv-39q9CGA-688p-crxp-gmg5CGA-6hwv-9h3h-5fjpCGA-723p-6gjg-58q6CGA-8499-gv6w-vp59CGA-8c9v-rcg4-68j9CGA-9hrf-26gr-8jcgCGA-cv75-x7wr-mxgpCGA-cv87-c6pg-hchcCGA-f4p7-xwqq-4526CGA-f83w-pxc6-p7c3CGA-f9m8-m8mm-p243CGA-fcx3-fc8g-36mmCGA-fv3c-7cj7-92pwCGA-g4wp-cg36-wrxcCGA-gcr2-hxmr-47cpCGA-gj7c-6vfg-w575CGA-jv65-rv2f-r6qvCGA-jvw3-w6fp-xg9qCGA-mcgx-7ghj-f7pgCGA-mmgv-8vp8-qq7rCGA-p2vh-wq2q-9jx2CGA-pghp-vpc4-6pq6CGA-pv47-2hj4-2c22CGA-2285-p4c6-2cwhCGA-2383-923w-gp8xCGA-2cgv-252m-h5wvCGA-2p5m-h58h-wvcpCGA-2vj3-p66v-fv8pCGA-2vp3-h8xq-gpvhCGA-2xw7-j728-4332CGA-35gp-p7gc-5fr3CGA-37x7-wmfh-49g8CGA-3gj3-82m6-w7gcCGA-3prc-86gq-v5xfCGA-4cfp-xv6f-7rghCGA-4chm-w93h-mf7cCGA-4q4f-prrc-3j3vCGA-556g-p8vg-7cfqCGA-56cm-jx6q-xqmxCGA-5c2p-mxq8-q7p8CGA-5f7f-582c-988qCGA-5mmw-285w-jf8qCGA-67jh-6ppr-2p96CGA-68cw-jvjq-xc2cCGA-693h-26wg-rx3hCGA-69cr-883v-fphhCGA-6wx9-r732-rppmCGA-772g-8v8p-jf54CGA-7hc5-xgx5-c6r2CGA-7hv3-2h5p-97qqCGA-7mcf-v3h3-cv96CGA-7rjf-q4cg-xfgjCGA-7xhc-mhgx-j8fcCGA-84r9-wh6f-3h5qCGA-888h-8v8v-x74rCGA-8fff-5m3m-5357CGA-8qqv-f9j8-2mchCGA-8vcm-3p68-8mj8CGA-92wx-f949-fr86CGA-98c9-744f-29p3CGA-9p36-9vfw-2jhjCGA-9p49-g5fh-fppcCGA-9qj5-v754-pv9hCGA-9vpv-fwpw-9xf5CGA-c3j4-7pxj-3gqxCGA-c699-695m-cchqCGA-c72v-8jxc-64rqCGA-ccmc-r8q6-g6hqCGA-cg32-hj4x-86rrCGA-cg3x-4f74-94fmCGA-cpjx-7pcw-v55xCGA-f48j-g9c8-g5r7CGA-f53h-2g34-9vrxCGA-fq64-67cv-7h77CGA-frjv-85cm-h6r4CGA-frr2-6v64-8rcvCGA-g2vc-374p-6rf4CGA-gp9q-7q4v-qq75CGA-h24j-8h77-h22cCGA-h858-682c-3h59CGA-h984-4xpq-92hwCGA-j2cw-39xp-r2v2CGA-j7j2-vqm4-2mjgCGA-jfwr-jw4w-mf3mCGA-jprf-rq47-4rppCGA-jwhh-29vm-2m47CGA-m59x-5x4q-4g93CGA-m7j9-cf6m-fr38CGA-m9c4-45r2-g4jwCGA-mhww-7pgf-vmw3CGA-mj4j-46wm-c57qCGA-mpmw-w3q2-q6crCGA-mqcc-g88j-p87hCGA-mr43-q34x-64w5CGA-mwvj-jwxc-gpgvCGA-mww5-m5j8-jm3mCGA-mxhm-5xv5-mc54CGA-p227-rw55-cvwvCGA-p6v5-pfj6-c4m9CGA-pp6x-mfqx-8f2qCGA-pqqg-7prc-r2xcCGA-q3hm-p6pc-82wpCGA-q9r7-xcjg-q67qCGA-qjq8-r2hj-grx3CGA-qm87-5cxf-5377CGA-qp88-79pp-x9fqCGA-qwfq-8p37-rrx8CGA-qwm7-mv8p-cqf8CGA-qx92-8fq4-hj86CGA-r4gm-qxxc-7xhhCGA-r4q6-jx4h-jf7jCGA-r5vq-776w-w5x6CGA-r66q-ww7x-7cc4CGA-r6fq-4x6h-c3c2CGA-r8cq-g94p-56c9CGA-rf82-vpvm-qf6cCGA-rr58-cv2v-c553CGA-rrjf-8wh7-rr8hCGA-rrxc-qf94-56c4CGA-v843-rc86-5g78CGA-v8hj-hv89-6cwmCGA-vc49-v83p-m352CGA-vg83-q6v4-m3fwCGA-vmfr-9cpq-pv3gCGA-vmv3-h4cw-q935CGA-vpx5-hf7f-8gwcCGA-vrqh-r35g-rggmCGA-w58w-3f45-9c8wCGA-w75c-f2h2-v6jpCGA-w7f8-wrgv-7p43CGA-w8gq-pr5f-rq4jCGA-w97m-3qwg-2xm7CGA-wmr8-377j-25wpCGA-wp8x-v7g5-pm68CGA-wpqr-55gh-8m96CGA-wv3m-49h4-2q99CGA-x2gw-cfch-p67xCGA-x5m2-86p9-cgqvCGA-x8g9-5hh5-ggjwCGA-xg7q-mxx6-pwpcCGA-xh7w-9prv-cvx6CGA-xvc8-q6v5-rvpqCGA-xwjx-x4vf-hr8pCGA-gq8r-6j96-655pCGA-qjmg-vr8f-49c5
Advisory lineage Upstream: 0 Downstream: 3
Deferred
Published: 17 Jul 2025, 15:47
Last modified:17 Jul 2025, 20:24

Vulnerability Summary

Overall Risk (default)
low
14/100
CVSS Score
3.4 LOW
v3.1 (cve.org)
EPSS Score
0.18% LOW
0% probability +0.18%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Jul 2025, 15:47
Published
Vulnerability first disclosed
17 Jul 2025, 20:24
Last Modified
Vulnerability information updated

Description

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.

CVSS Metrics

  • v3.1•LOW•Score: 3.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.18%• Percentile: 8%

Techniques & Countermeasures

  • CWE-241•Improper Handling of Unexpected Data Type

    The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).

Affected Systems

  • chainguard•arangodb-3.11

    all | < 3.11.14.5-r25

  • chainguard•arangodb-3.12

    all | < 3.12.11-r0

  • chainguard•argo-workflows

    < 3.6.10-r3

  • chainguard•code-server

    < 4.102.1-r0

  • chainguard•code-server-compat

    < 4.102.1-r0

  • chainguard•gitlab-rails-ce-18.1

    all

  • chainguard•gitlab-rails-ce-18.10

    all

  • chainguard•gitlab-rails-ce-18.11

    all

  • chainguard•gitlab-rails-ce-18.5

    all

  • chainguard•gitlab-rails-ce-18.6

    all

  • chainguard•gitlab-rails-ce-18.7

    all

  • chainguard•gitlab-rails-ce-18.8

    all

  • chainguard•gitlab-rails-ce-18.9

    all

  • chainguard•gitlab-rails-ce-19.0

    all | < 19.0.3-r1

  • chainguard•gitlab-rails-ce-19.1

    all | < 19.1.7-r6

  • chainguard•gitlab-rails-ce-19.2

    all | < 19.2.5-r2

  • chainguard•gitlab-rails-ce-19.3

    < 19.3.1-r6

  • chainguard•gitlab-rails-ce-fips-18.1

    all | < 18.1.6-r15

  • chainguard•gitlab-rails-ce-fips-18.10

    all

  • chainguard•gitlab-rails-ce-fips-18.11

    all

  • chainguard•gitlab-rails-ce-fips-18.5

    all

  • chainguard•gitlab-rails-ce-fips-18.6

    all

  • chainguard•gitlab-rails-ce-fips-18.7

    all

  • chainguard•gitlab-rails-ce-fips-18.8

    all

  • chainguard•gitlab-rails-ce-fips-18.9

    all

  • chainguard•gitlab-rails-ce-fips-19.0

    all

  • chainguard•gitlab-rails-ce-fips-19.1

    < 19.1.1-r1 | all | < 19.1.7-r7

  • chainguard•gitlab-rails-ce-fips-19.2

    all | < 19.2.5-r2

  • chainguard•gitlab-rails-ce-fips-19.3

    < 19.3.1-r3

  • chainguard•json-server

    < 0.17.4-r2

  • chainguard•katib-earlystopping

    < 0.19.0-r31

  • chainguard•katib-suggestion-goptuna-compat

    < 0.19.0-r40

  • chainguard•katib-suggestion-hyperband

    < 0.19.0-r31

  • chainguard•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • chainguard•katib-suggestion-nas-darts

    < 0.19.0-r31

  • chainguard•katib-suggestion-nas-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • chainguard•katib-tfevent-metricscollector

    < 0.19.0-r31

  • chainguard•kubeflow-centraldashboard

    < 1.10.0-r3

  • chainguard•serve

    < 14.2.5-r0

  • chainguard•sqlpad

    < 7.5.4-r3

  • chainguard•sqlpad-compat

    < 7.5.4-r3

  • chainguard•thingsboard

    < 4.1-r5

  • chainguard•thingsboard-tb-js-executor

    < 4.1-r5

  • chainguard•thingsboard-tb-mqtt-transport

    < 4.1-r5

  • chainguard•thingsboard-tb-node

    < 4.1-r5

  • chainguard•thingsboard-tb-web-ui

    < 4.1-r5

  • chainguard•tileserver-gl

    < 5.3.1-r7

Showing first 50 affected entries in server-rendered view.

References (9)