PT-2026-45831 · Git · Crow

Notfresh · CVE-2026-38967 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CrowCpp Crow versions prior to 1.3.2

Description HTTP is susceptible to response header injection because response header values are not properly validated.

Recommendations Update to version 1.3.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2026-38967

Affected Products

Crow

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38967.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-38967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-38967 · Security Note
• https://github.com/CrowCpp/Crow/pull/1167 · Note
• https://github.com/CrowCpp/Crow/issues/1165 · Note