PT-2026-35920 · Tubitak Bilgem · Pardus

Çağrı Eser · Published 2026-04-29 · Updated 2026-06-08 · CVE-2026-5140

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pardus versions 0.6.4 through 0.7.x

Description Improper neutralization of CRLF sequences, also known as CRLF injection, in TUBITAK BILGEM Software Technologies Research Institute Pardus allows for Authentication Bypass. CRLF injection occurs when an application fails to filter carriage return (CR) and line feed (LF) characters, allowing an attacker to inject new lines into HTTP headers.

Recommendations Update to version 0.8.0.

Fix

LPE

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-5140

Affected Products

Pardus

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-5140 · Security Note
• https://t.me/pentestingnews/74365 · Telegram Post
• https://twitter.com/Tank23x0/status/2064045043229581337 · Twitter Post
• https://twitter.com/threatcluster/status/2057119386138288477 · Twitter Post
• https://usom.gov.tr/bildirim/tr-26-0131 · Note
• https://twitter.com/CVEnew/status/2049594360811974921 · Twitter Post
• https://twitter.com/DFIR_Radar/status/2057371710689583140 · Twitter Post
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0131 · Note
• https://twitter.com/OrizonCyber/status/2049496447440089414 · Twitter Post