CVE-2026-1527

Aliases:GHSA-4992-7rv2-5pvqDEBIAN-CVE-2026-1527CGA-632g-q9hw-23x6CGA-77gm-882v-3w4cCGA-gx95-hcq6-j46hCGA-h4m5-76mc-qgcpCGA-h9gw-qvqr-gm7cCGA-hj5j-mrwv-55jfCGA-mc2q-qxhg-g7hrCGA-px9h-3w6q-jxg8CGA-2whg-24pm-84qxCGA-2wv7-2x4c-wf76CGA-2ww3-jrg7-px3gCGA-3787-8hw5-5x87CGA-43hv-fmg7-7xqhCGA-4q5m-vgv5-5cwmCGA-4wr2-3qgx-mmf4CGA-59pp-r742-hrc6CGA-59wq-mgmq-4j64CGA-5xq5-rjqv-hv8cCGA-63mw-66jf-3mmgCGA-67gx-3qww-q44cCGA-6xpg-jp49-cx32CGA-6xqp-r7hh-4mw4CGA-789c-pmx9-9rw7CGA-8g9m-7vg4-8q4gCGA-93wx-6vfc-q2rrCGA-946m-rg67-3v58CGA-96h3-m52x-3rf3CGA-9f44-qx7q-pc67CGA-c2g5-87hp-mg46CGA-gw73-r463-4wwcCGA-gx44-7rfg-fjfvCGA-h8jp-5w8r-vg55CGA-hvx8-w8f6-x578CGA-j7m8-vq3j-wfq5CGA-jg8m-ghj4-f2qfCGA-jvhh-95jq-fhq9CGA-m3wm-3r75-6qp6CGA-mhhc-2fpv-qgpgCGA-mr8p-xhpr-f352CGA-mwcf-h63w-p6f9CGA-p58p-pp2w-jxvjCGA-pg2v-g3g5-h72cCGA-ppwv-25h9-23q9CGA-qmvh-h75f-jr29CGA-r4vg-hxq4-26cmCGA-r9pv-qw88-4cqxCGA-rh9v-qgjj-84x3CGA-rw3x-wq9f-24f9CGA-v7hj-qq7v-x8gqCGA-wggc-7pmm-wmjjCGA-wr7m-6q68-c7gmCGA-wxcq-546j-4h6mCGA-x2rr-82jw-fp53CGA-x4g2-758f-2mg9CGA-xhhf-7c89-vrpwCGA-xvjm-xwqw-8hwvCGA-xwxj-9h92-wxggCGA-xxgp-crrw-2946
Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 12 Mar 2026, 20:17
Last modified:13 Mar 2026, 18:06

Vulnerability Summary

Overall Risk (default)
low
18/100
CVSS Score
4.6 MEDIUM
v3.1 (cve.org)
EPSS Score
0.28% LOW
0% probability +0.26%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Mar 2026, 20:17
Published
Vulnerability first disclosed
13 Mar 2026, 18:06
Last Modified
Vulnerability information updated

Description

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters: // lib/dispatcher/client-h1.js:1121 if (upgrade) { header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n` }

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.28%• Percentile: 20%

Techniques & Countermeasures

  • CWE-93•Improper Neutralization of CRLF Sequences ('CRLF Injection')

    The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Affected Systems

  • chainguard•code-server

    < 4.110.1-r2

  • chainguard•gemini-cli

    < 0.49.0-r4

  • chainguard•jitsucom-jitsu-console

    < 2.11.0-r17

  • chainguard•jitsucom-jitsu-rotor

    < 2.11.0-r17

  • chainguard•kibana-8.17

    < 8.17.10-r13

  • chainguard•kibana-8.17-bitnami

    < 8.17.10-r13

  • chainguard•kibana-8.17-iamguarded

    < 8.17.10-r13

  • chainguard•kibana-8.18

    < 8.18.8-r11

  • chainguard•kibana-8.18-bitnami

    < 8.18.8-r11

  • chainguard•kibana-8.18-iamguarded

    < 8.18.8-r11

  • chainguard•kibana-8.19

    < 8.19.13-r4

  • chainguard•kibana-8.19-bitnami

    < 8.19.13-r4

  • chainguard•kibana-8.19-iamguarded

    < 8.19.13-r4

  • chainguard•kibana-9.0

    < 9.0.8-r14

  • chainguard•kibana-9.0-bitnami

    < 9.0.8-r14

  • chainguard•kibana-9.0-iamguarded

    < 9.0.8-r14

  • chainguard•kibana-9.1

    < 9.1.10-r7

  • chainguard•kibana-9.1-iamguarded

    < 9.1.10-r7

  • chainguard•kibana-9.2

    < 9.2.6-r3 | < 9.2.7-r0

  • chainguard•kibana-9.2-iamguarded

    < 9.2.6-r3

  • chainguard•kibana-9.3

    < 9.3.2-r0

  • chainguard•kibana-9.3-iamguarded

    < 9.3.2-r0 | < 9.3.1-r2

  • chainguard•langfuse-3-worker

    < 3.179.1-r1

  • chainguard•langfuse-fips-3-worker

    < 3.179.1-r1

  • chainguard•langfuse-fips-3.152-worker

    all

  • chainguard•librechat

    < 0.8.4-r3

  • chainguard•pelias-api

    < 7.6.0-r4

  • chainguard•renovate

    < 43.84.0-r1

  • wolfi•code-server

    < 4.110.1-r2

  • wolfi•jitsucom-jitsu-console

    < 2.11.0-r17

  • wolfi•jitsucom-jitsu-rotor

    < 2.11.0-r17

  • wolfi•langfuse-3-worker

    < 3.179.1-r1

  • wolfi•renovate

    < 43.84.0-r1

  • debian•node-undici

    all | < 7.24.5+dfsg+~cs3.2.0-1

  • nodejs•undici

    < 6.24.0 | ≥ 7.0.0, < 7.24.0

  • Npm•undici

    < 6.24.0 | ≥ 7.0.0, < 7.24.0

  • undici•undici

    < 6.24.0; 7.0.0 < 7.24.0

References (8)