CVE-2026-34715 Details
Description
ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content, leading to response splitting, cache poisoning, and possible cross-site scripting. Notably, ewe does validate CRLF in incoming request headers via validate_field_value() in the HTTP/1.1 parser — but provides no equivalent protection for outgoing response headers in the encoder. This issue has been patched in version 3.0.6.
A vulnerability exists in the ewe web server, specifically in versions prior to 3.0.6. The issue arises in the encode_headers function, which improperly handles response header keys and values by directly inserting them into raw HTTP bytes without validating or removing carriage return and line feed (CRLF) sequences. This flaw allows for HTTP response splitting, cache poisoning, and potentially cross-site scripting, especially when user-controlled data is included in response headers, such as Location redirect headers. While ewe does validate CRLF in incoming request headers, it lacks similar protection for outgoing response headers, leaving a critical gap that can be exploited.
Users can update to ewe version 3.0.6 or later, where this vulnerability has been patched. The update process involves downloading the latest version from the ewe GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vshakitskiy/ewe/security/advisories/GHSA-x2w3-23jr-hrpf | CISA-ADP | ExploitVendor Advisory |
| https://github.com/vshakitskiy/ewe/commit/ce4ff214d32626a10fda9398dc94a2d720e17446 | [email protected] | Patch |
| https://github.com/vshakitskiy/ewe/releases/tag/v3.0.6 | [email protected] | ProductRelease Notes |
| https://github.com/vshakitskiy/ewe/security/advisories/GHSA-x2w3-23jr-hrpf | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vshakitskiy ewe | < 3.0.6 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Apr 3, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | New CVE Received | [email protected] |