CVE-2025-61689: HTTP.jl CRLF Injection XSS Vulnerability

CVE-2025-61689 Overview

CVE-2025-61689 is an HTTP response splitting and header injection vulnerability in HTTP.jl, the HTTP client and server library for the Julia programming language. Versions prior to 1.10.19 fail to validate header names and values for illegal characters, including carriage return and line feed (CRLF) sequences. Attackers can inject crafted CRLF sequences into headers to split responses, poison caches, conduct cross-site scripting (XSS), and perform session fixation. The flaw is tracked under CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers. The maintainers resolved the issue in HTTP.jl v1.10.19.

Critical Impact
Unauthenticated network attackers can inject arbitrary HTTP headers and split responses, enabling cache poisoning, XSS, and session fixation against applications built on HTTP.jl.

Affected Products

HTTP.jl for Julia, all versions prior to 1.10.19
Julia applications using HTTP.jl as an HTTP client
Julia applications using HTTP.jl as a server framework

Discovery Timeline

2025-10-10 - CVE-2025-61689 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-61689

Vulnerability Analysis

HTTP.jl constructs HTTP requests and responses without sanitizing header names or values for control characters. When user-controlled input flows into a header, attackers can embed CRLF (\r\n) sequences. The receiving parser interprets these sequences as header terminators, allowing an attacker to inject additional headers or terminate the header block and begin a new response body.

This class of flaw, formally categorized as HTTP Response Splitting, breaks the boundary between the protocol metadata layer and the application payload. Downstream proxies, caches, and browsers consume the malformed stream as if it were two distinct responses. The attacker controls the second response and can substitute arbitrary HTML, cookies, or redirect directives.

The practical consequences include web cache poisoning against shared intermediaries, reflected XSS through injected Content-Type: text/html bodies, session fixation via injected Set-Cookie headers, and open redirection through forged Location values.

Root Cause

The root cause is missing input validation on header names and values within HTTP.jl's request and response construction paths. The library accepted any string as a header component and serialized it verbatim onto the wire. No filter rejected \r, \n, or NUL bytes before transmission, violating the header syntax rules defined in RFC 7230.

Attack Vector

Exploitation requires only network access to an application that forwards untrusted input into HTTP.jl headers. A typical attack URL embeds URL-encoded CRLF sequences (%0d%0a) in a parameter that the server reflects into a Location, Set-Cookie, or custom header. When HTTP.jl serializes the response, the injected bytes terminate the legitimate header and inject attacker-controlled content. See the GitHub Security Advisory GHSA-h3x8-ppwj-6vcj for protocol-level details.

No verified proof-of-concept code has been published. The vulnerability mechanism follows the standard CRLF injection pattern documented in CWE-113.

Detection Methods for CVE-2025-61689

Indicators of Compromise

HTTP request logs containing raw or URL-encoded CRLF sequences (%0d%0a, \r\n) in query parameters, path segments, or header values
Unexpected Set-Cookie, Location, or Content-Type headers appearing in responses generated by Julia HTTP.jl services
Cache entries with duplicated HTTP status lines or anomalous header counts
Outbound HTTP.jl client requests containing control characters in custom header fields

Detection Strategies

Inspect application and web application firewall (WAF) logs for header values containing \r, \n, or their URL-encoded variants
Audit Julia codebases for HTTP.jl calls that interpolate untrusted input into headers= arguments without validation
Compare deployed HTTP.jl package versions against 1.10.19 using Pkg.status() across all Julia environments

Monitoring Recommendations

Forward HTTP.jl server access logs to a centralized analytics platform and alert on CRLF byte patterns in request fields
Monitor cache layers (Varnish, CDN, reverse proxies) for response splitting anomalies such as duplicate HTTP/1.1 status lines
Track outbound traffic from Julia services for malformed headers that may indicate exploitation of the client-side request path

How to Mitigate CVE-2025-61689

Immediate Actions Required

Upgrade HTTP.jl to version 1.10.19 or later in every Julia project, including transitive dependencies
Audit application source code for locations where user input flows into HTTP headers and add explicit validation
Invalidate cached responses on shared caches and CDNs that may contain poisoned entries
Rotate session identifiers if logs indicate suspicious Set-Cookie activity during the exposure window

Patch Information

The maintainers fixed the issue in HTTP.jl Release v1.10.19. The patch adds validation that rejects illegal characters in header names and values before serialization. Update via the Julia package manager with Pkg.update("HTTP") and verify the resolved version with Pkg.status("HTTP").

Workarounds

Strip or reject CRLF bytes (\r, \n) and NUL characters from any user-supplied data before passing it to HTTP.jl header constructors
Deploy a WAF rule that blocks requests containing %0d%0a, %0a, or raw CRLF in query strings and headers
Restrict header values to a strict allowlist of printable ASCII when building responses from untrusted input

bash

# Upgrade HTTP.jl to the patched release
julia -e 'using Pkg; Pkg.update("HTTP"); Pkg.status("HTTP")'

# Verify the installed version meets or exceeds 1.10.19
julia -e 'using Pkg; v = Pkg.dependencies()[Base.UUID("cd3eb016-35fb-5094-929b-558a96fad6f3")].version; @assert v >= v"1.10.19"'