PT-2026-32601 · Apache · Apache Apisix

Seungmyung Lee · Published 2026-04-14 · Updated 2026-04-16 · CVE-2026-31908

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.12.0 through 3.15.0

Description A header injection issue exists in the forward-auth plugin due to improper neutralization of CRLF sequences (Carriage Return Line Feed, a special sequence of characters used to mark the end of a line of text). A remote attacker can exploit this by sending specially crafted HTTP requests to inject malicious headers, potentially bypassing security mechanisms and gaining unauthorized access to protected information.

Recommendations Upgrade to version 3.16.0.

Exploit

Fix

Weakness Enumeration

CWE-93

CWE-75

Related Identifiers

BDU:2026-05625

BIT-APISIX-2026-31908

CVE-2026-31908

Affected Products

Apache Apisix

References · 7

• 🔥 https://github.com/MehranTurk/CVE-2026-31908 · Exploit
• https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31908 · Security Note
• https://bdu.fstec.ru/vul/2026-05625 · Security Note
• https://osv.dev/vulnerability/BIT-apisix-2026-31908 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/04/14/3 · Note
• https://twitter.com/oss_security/status/2043884994817314874 · Twitter Post