CRLF Injection in RestSharp's RestRequest.AddHeader method

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

5.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P · score source

EPSS

• CVE-2024-45302: 0.32% estimated exploitation activity in the next 30 days; percentile 24.63 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary The second argument to RestRequest.AddHeader (the header value) is vulnerable to CRLF injection. The same applies to RestRequest.AddOrUpdateHeader and RestClient.AddDefaultHeader. Details The way HTTP headers are added to a request is via the HttpHeaders.TryAddWithoutValidation method: <https://github.com/restsharp/RestSharp/blob/777bf194ec2d14271e7807cc704e73ec18fcaf7e/src/RestSharp/Request/HttpRequestMessageExtensions.cs#L32 This method does not check for CRLF characters in the header value. This means that any headers from a RestSharp.RequestHeaders object are added to the request in such a way that they are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests. PoC The below example code creates a console app that takes one command line variable "api key" and then makes a request to some status page with the provided key inserted in the…

Published by the source

29 Aug 2024, 19:30 UTC

Last modified by the source

1 Oct 2024, 21:48 UTC

Source last checked

26 Oct 2026, 17:00 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-4rr6-2v9v-wcpc

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-45302

Advisory: CRLF Injection in RestSharp's `RestRequest.AddHeader` method
IDs: CVE-2024-45302, GHSA-4rr6-2v9v-wcpc
Record: https://patchnext.com/advisories/cve-2024-45302 (revision 1, source checked 26 Oct 2026, 17:00 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.7)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: restsharp 112.0.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- NuGet restsharp: affected >= 107.0.0-preview.1, < 112.0.0; fixed in 112.0.0

## Suggested inspection (read-only)
- NuGet restsharp: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on restsharp.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-4rr6-2v9v-wcpc (GitHub-reviewed advisory GHSA-4rr6-2v9v-wcpc lists affected ranges: NuGet restsharp >=107.0.0-preview.1 <112.0.0)

Commands are suggestions: review each one before running it.