Skip to main content

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

CVE-2025-61689 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2025-61689

CVE-2025-61689

HIGH8.7

HTTP.jl vulnerable to Header injection/Response splitting via header construction.

Published Oct 10, 2025

Modified 4 months ago

Details

HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header injection, leading to cache poisoning, XSS, session fixation, and more. This issue is fixed in HTTP.jl v1.10.19.

References

https://github.com/JuliaWeb/HTTP.jl/releases/tag/v1.10.19

https://github.com/JuliaWeb/HTTP.jl/security/advisories/GHSA-h3x8-ppwj-6vcj

https://www.cve.org/CVERecord?id=CVE-2025-61689

CVSS Analysis

CVSS v4.0

8.7

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

HighVI:H

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

HighSI:H

Subseq. Availability

NoneSA:N

8.7/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P

Weakness Type (CWE)

Input Validation

HTTP Response Splitting

Ecosystems

Timeline

PublishedOct 10, 2025

ModifiedOct 10, 2025