PT-2026-29666 · Ewe · Ewe

Athuljayaram · Published 2026-04-01 · Updated 2026-04-03 · CVE-2026-34715

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ewe versions prior to 3.0.6

Description The encode headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (r ) sequences. This allows an attacker to inject arbitrary HTTP response content when user-controlled data is passed into response headers, potentially leading to response splitting, cache poisoning, and cross-site scripting. The issue stems from the lack of validation for outgoing response headers, while incoming request headers are validated via validate field value() in the HTTP/1.1 parser. The vulnerable code is located in the encode headers function, where both key and value are directly embedded into the output BitArray without sanitization. An example of exploitation involves setting a Location redirect header from a request parameter containing CRLF sequences.

Recommendations Update to version 3.0.6 or later.

Exploit

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2026-34715

GHSA-X2W3-23JR-HRPF

Affected Products

Ewe

References · 8

• 🔥 https://github.com/vshakitskiy/ewe/security/advisories/GHSA-x2w3-23jr-hrpf · Exploit
• https://github.com/vshakitskiy/ewe/commit/ce4ff214d32626a10fda9398dc94a2d720e17446 · Patch
• https://osv.dev/vulnerability/GHSA-x2w3-23jr-hrpf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34715 · Security Note
• https://github.com/vshakitskiy/ewe · Note
• https://github.com/vshakitskiy/ewe/releases/tag/v3.0.6 · Note
• https://twitter.com/infoflowcloud/status/2040130132657004585 · Twitter Post
• https://twitter.com/CVEnew/status/2040128815645569042 · Twitter Post