CVE-2026-24489: Gakido HTTP Header Injection Vulnerability

CVE-2026-24489 Overview

CVE-2026-24489 is an HTTP Header Injection vulnerability discovered in Gakido, a Python HTTP client focused on browser impersonation and anti-bot evasion. The vulnerability allows attackers to inject arbitrary HTTP headers through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names. When making HTTP requests with user-controlled header values containing \r\n (CRLF), \n (LF), or \\x00 (null byte) characters, an attacker could inject arbitrary HTTP headers into the request, potentially leading to HTTP response splitting, cache poisoning, or session fixation attacks.

Critical Impact

Attackers can inject arbitrary HTTP headers into requests, enabling potential HTTP response splitting, cache poisoning, cross-site scripting, or session manipulation attacks against downstream systems.

Affected Products

• Gakido Python HTTP Client versions prior to 0.1.1

Discovery Timeline

• 2026-01-27 - CVE CVE-2026-24489 published to NVD
• 2026-01-27 - Last updated in NVD database

Technical Details for CVE-2026-24489

Vulnerability Analysis

This vulnerability falls under CWE-93 (Improper Neutralization of CRLF Sequences). The Gakido HTTP client failed to sanitize user-supplied header names and values before including them in HTTP requests. This oversight allowed attackers to inject special characters—specifically carriage return (\r), line feed (\n), and null byte (\\x00) characters—into HTTP headers.

When an application using Gakido accepts user input and passes it as HTTP header values, an attacker could craft malicious input containing CRLF sequences to terminate the current header and inject additional headers. This technique can be leveraged for various attacks including HTTP response splitting, cache poisoning, and cross-site scripting when the injected headers influence how downstream servers or proxies process the request.

Root Cause

The root cause of this vulnerability was the absence of input sanitization in the header processing logic. The Gakido library did not validate or sanitize header names and values before incorporating them into outgoing HTTP requests. Without proper filtering of control characters, the library blindly trusted user-supplied input, allowing injection of arbitrary header content through CRLF sequences.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by providing malicious input to any application that uses Gakido to make HTTP requests with user-controlled header values. The attacker crafts input containing CRLF sequences followed by arbitrary header content, which gets injected into the HTTP request.

For example, an attacker could provide a header value like legitimate-value\r\nX-Injected-Header: malicious-data to inject the X-Injected-Header into the outgoing request.

The security patch introduces a _sanitize_header() function that strips dangerous characters:

def _sanitize_header(name: str, value: str) -> tuple[str, str]:
    """
    Sanitize header name and value to prevent HTTP header injection (CRLF injection).
    Strips CR, LF, and null bytes from both name and value.
    """
    # Remove \r, \n, and \\x00 from header name and value
    clean_name = name.replace("\r", "").replace("\n", "").replace("\\x00", "")
    clean_value = value.replace("\r", "").replace("\n", "").replace("\\x00", "")
    return clean_name, clean_value

Source: GitHub Commit Update

Detection Methods for CVE-2026-24489

Indicators of Compromise

• HTTP requests containing unexpected or additional headers not set by the application
• Log entries showing CRLF sequences (\r\n, %0d%0a) in header values
• Anomalous HTTP traffic patterns with injected headers like X-Injected-Header or duplicate standard headers

Detection Strategies

• Monitor application logs for header values containing encoded or literal CRLF sequences
• Implement web application firewall (WAF) rules to detect and block CRLF injection attempts in HTTP headers
• Review network traffic for HTTP requests with malformed or unexpected header structures
• Audit code using Gakido library for user-controlled header input without validation

Monitoring Recommendations

• Enable detailed logging for HTTP client operations to capture full header content
• Set up alerts for unusual header patterns or header injection signatures in outbound traffic
• Monitor dependency management systems for outdated Gakido versions in your environment

How to Mitigate CVE-2026-24489

Immediate Actions Required

• Upgrade Gakido to version 0.1.1 or later immediately
• Audit all applications using Gakido to identify those passing user-controlled input as HTTP headers
• Implement input validation as a defense-in-depth measure, even after upgrading
• Review HTTP logs for signs of exploitation attempts

Patch Information

The vulnerability has been fixed in Gakido version 0.1.1. The patch adds a _sanitize_header() function that removes carriage return (\r), line feed (\n), and null byte (\\x00) characters from both header names and values before they are included in HTTP requests. The fix is available in commit 369c67e67c63da510c8a9ab021e54a92ccf1f788. See the GitHub Security Advisory GHSA-gcgx-chcp-hxp9 for more details.

Workarounds

• If immediate upgrade is not possible, implement application-level sanitization to strip CRLF and null byte characters from any user input before passing it to Gakido header functions
• Use a web application firewall to filter requests containing CRLF injection patterns
• Restrict user input from being directly used in HTTP header values where possible

# Upgrade Gakido to the patched version
pip install --upgrade gakido>=0.1.1

# Verify installed version
pip show gakido | grep Version