N0Npax

**Name of the Vulnerable Software and Affected Versions** dio package versions prior to 5.0.0 **Description** The issue allows CRLF injection if the attacker controls the HTTP method string. This is a different issue than previously identified problems. **Recommendations** For dio package versions prior to 5.0.0, update to version 5.0.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** http package versions 0.12.2 and earlier http package versions prior to 0.13.3 **Description** An issue was discovered in the http package for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request via HTTP header injection. **Recommendations** For versions 0.12.2 and earlier, update to version 0.13.3 or later to address the issue. For versions prior to 0.13.3, update to version 0.13.3 or later to address the issue. As a temporary workaround, consider validating request methods to prevent CRLF injection in HTTP requests.