CVE-2018-1067
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2018-1067
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
HTTP头部中CRLF序列转义处理不恰当(HTTP响应分割)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Red Hat Undertow 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Undertow是美国红帽（Red Hat）公司的一款基于Java的嵌入式Web服务器，是Wildfly（Java应用服务器）默认的Web服务器。 Red Hat Undertow 7.1.2.CR1之前版本和7.1.2.GA之前版本中存在安全漏洞，该漏洞源于程序将用户输入用作HTTP包头值之前，没有充分的过滤和验证该输入。攻击者可利用该漏洞注入任意的PHP包头，造成响应拆分。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2018-1067
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-1067
请登录查看更多情报信息。
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1067x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2018-1067
IV. Related Vulnerabilities
Same weakness: CWE-113
- CVE-2026-42578
Netty: HTTP Header Injection via HttpProxyHandler Disabled V - CVE-2026-7010
HTTP::Tiny versions before 0.093 for Perl do not validate CR - CVE-2026-42874
Microdot: HTTP response splitting in Response.set_cookie() - CVE-2026-42035
Axios: Header Injection via Prototype Pollution - CVE-2026-39971
Serendipity: Host Header Injection leads to SMTP header inje
V. Comments for CVE-2018-1067
No comments yet