Medium, CVSS 5.3PyPIAmendedPublished
Gakido vulnerable to HTTP Header Injection (CRLF Injection)
CVE-2026-24489 · GHSA-gcgx-chcp-hxp9
- Affected
- PyPI gakido < 0.1.1
- Fixed in
- 0.1.1· Vendor fix available
- Issue
- A vulnerability was discovered in Gakido that allowed HTTP Header Injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names. When making HTTP requests with user-controlled header values containing \r\n (CRLF), \n (LF), or \x00 (null byte) characters, an attacker could inject arbitrary HTTP headers into the request. Impact An attacker who can control header values passed to Gakido's Client.get(), Client.post(), or other request methods could: 1. Inject arbitrary HTTP headers - Add malicious headers to requests 2. HTTP Response Splitting - Potentially manipulate responses in certain proxy configurations 3. Cache Poisoning - Inject headers that could poison intermediate caches 4. Session Fixation - Inject session-related headers 5. Bypass Security Controls - Inject headers that bypass server-side security checks Proof of Concept Affected Code The vulnerability existed in the header processing logic where user-supplied headers were not…
Recommended action: Upgrade to 0.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.