PT-2025-41579 · Http.Jl · Http.Jl

Chen T · Published 2025-10-10 · Updated 2025-10-14 · CVE-2025-61689

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions HTTP.jl versions prior to 1.10.19

Description HTTP.jl, an HTTP client and server for the Julia programming language, did not properly validate header names and values, creating a risk of header injection and response splitting. This could lead to several security issues, including cache poisoning, cross-site scripting (XSS), and session fixation. The issue stems from a lack of validation for illegal characters in header data. The vulnerable component is the handling of HTTP headers.

Recommendations Update HTTP.jl to version 1.10.19 or later.

Exploit

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2025-61689

GHSA-H3X8-PPWJ-6VCJ

JLSEC-2025-40

Affected Products

Http.Jl

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61689.json · Exploit
• https://osv.dev/vulnerability/JLSEC-2025-40 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61689 · Security Note
• https://github.com/JuliaWeb/HTTP.jl/security/advisories/GHSA-h3x8-ppwj-6vcj · Note
• https://github.com/JuliaWeb/HTTP.jl/releases/tag/v1.10.19 · Note
• https://twitter.com/CVEnew/status/1976698119032389981 · Twitter Post
• https://t.me/CVEtracker/34603 · Telegram Post
• https://t.me/cveNotify/138183 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1976840183791174027 · Twitter Post
• https://twitter.com/CveFindCom/status/1976696630305812771 · Twitter Post