GHSA-9324-jv53-9cc8 CVE-2021-31402
dio vulnerable to CRLF injection with HTTP method string
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.17%
- Chance of exploitation in the next 30 days. Higher than 67.36% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
- Fix
5.0.0- Upgrade dio to this version or later
Description
Impact
The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669.
Patches
The vulnerability has been resolved by https://github.com/cfug/dio/commit/927f79e93ba39f3c3a12c190624a55653d577984, and included since v5.0.0.
Workarounds
Cherry-pick the commit to your own fork can resolves the vulberability too.
References
Affected versions
Pub
| Package | Vulnerable | Fixed in |
|---|---|---|
| dio | < 5.0.0 |
5.0.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
dio Pub → 5.0.0
- dart
dart pub add dio:^5.0.0
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
How to prevent it
- Implementation: Avoid using CRLF as a special sequence.
- Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-h4x7-gw46-3wm6 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers | Medium | Same weakness, CWE-93 |
| GHSA-j9f9-w8pj-32f8 Spring Framework Server Sent Event stream corruption while rendering fragments | Critical | Same weakness, CWE-93 |
| EEF-CVE-2026-75484 HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit | Not rated yet | Same weakness, CWE-93 |
| GHSA-8c48-q9wj-3w37 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines | Medium | Same weakness, CWE-93 |
| GHSA-m8rv-5g2x-5cg5 undici vulnerable to CRLF Injection via blob-like body 'type' property | Medium | Same weakness, CWE-93 |
| GHSA-gcjf-9mgh-3p7g Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder | Medium | Same weakness, CWE-93 |
| GHSA-cfj9-2vgr-hpxp Jenkins Script Security Plugin has a script security bypass vulnerability | High | Same weakness, CWE-93 |
| GHSA-4v4h-m2qq-ppgw Kirby: Request header injection in `Http\Remote` | Medium | Same weakness, CWE-93 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor