CVE-2026-34715: Gleam ewe Web Server XSS Vulnerability

CVE-2026-34715 Overview

CVE-2026-34715 is an HTTP Response Splitting vulnerability affecting ewe, a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content.

This vulnerability enables response splitting attacks, which can lead to cache poisoning and potential cross-site scripting (XSS). Notably, ewe does validate CRLF in incoming request headers via validate_field_value() in the HTTP/1.1 parser, but provides no equivalent protection for outgoing response headers in the encoder.

Critical Impact
Attackers can inject arbitrary HTTP headers and response content through user-controlled data passed to response headers, enabling response splitting, cache poisoning, and cross-site scripting attacks.

Affected Products

ewe Gleam web server versions prior to 3.0.6

Discovery Timeline

2026-04-02 - CVE CVE-2026-34715 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34715

Vulnerability Analysis

The vulnerability exists in the HTTP response encoding mechanism of the ewe web server. When generating HTTP responses, the encode_headers function processes header keys and values without sanitizing CRLF sequences. In HTTP/1.1, CRLF (\r\n) serves as the delimiter between headers and between the header section and response body. When user-controlled input containing these sequences is interpolated into response headers, an attacker can inject additional headers or even control the response body.

The asymmetric validation approach creates a security gap: while incoming request headers are properly validated through validate_field_value(), outgoing response headers lack this protection. This design flaw allows attackers to exploit applications that dynamically construct response headers from user input, such as redirect endpoints that use URL parameters to set the Location header.

Root Cause

The root cause is improper input validation (CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers) in the response header encoder. The encode_headers function in src/ewe/internal/encoder.gleam fails to sanitize or reject header values containing CRLF sequences before interpolating them into the raw HTTP response bytes.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by supplying crafted input to any application endpoint that reflects user data into HTTP response headers. Common attack scenarios include:

Manipulating redirect endpoints by injecting CRLF into URL parameters used for Location headers
Poisoning intermediate caches by injecting cache-control headers
Injecting malicious content into the response body to achieve XSS

The following patch was applied to address this vulnerability:

text

 -module(ewe_ffi).
 
 -export([close_file/1, decode_packet/3, init_clock_storage/0, lookup_http_date/0, now/0,
-         now_microseconds/0, open_file/1, set_http_date/1, validate_field_value/1,
+         now_microseconds/0, open_file/1, set_http_date/1, validate_lowercase_field/1,
+         validate_field_value/1, validate_lowercase_field_value/1, sanitize_header_value/1,
          coerce_tcp_message/1, parse_path/1]).
 
 % Socket

Source: GitHub Commit

The fix introduces new validation functions including sanitize_header_value/1, validate_lowercase_field/1, and validate_lowercase_field_value/1 to properly sanitize outgoing response headers.

Detection Methods for CVE-2026-34715

Indicators of Compromise

HTTP response logs showing unexpected additional headers or malformed responses
Web application firewall (WAF) alerts detecting CRLF sequences (%0d%0a or \r\n) in user input destined for header values
Cache servers storing poisoned responses with injected headers
Reports of XSS or unexpected content rendering from users

Detection Strategies

Monitor application logs for redirect URLs or header values containing encoded CRLF sequences (%0d, %0a, %0D%0A)
Implement WAF rules to detect and block requests containing CRLF injection patterns in parameters used for response headers
Audit application code for endpoints that pass user-controlled data to response headers without sanitization
Review ewe server version deployed in production environments

Monitoring Recommendations

Enable detailed HTTP response logging to capture full header content
Configure alerting for anomalous response patterns such as unexpected header counts or content-type mismatches
Monitor cache hit/miss ratios for signs of cache poisoning attacks
Implement integrity checks on cached responses for critical endpoints

How to Mitigate CVE-2026-34715

Immediate Actions Required

Upgrade ewe web server to version 3.0.6 or later immediately
Review all application code that sets response headers from user-controlled input
Implement input validation at the application layer to reject or sanitize CRLF sequences
Deploy WAF rules to block HTTP response splitting attack patterns

Patch Information

The vulnerability has been patched in ewe version 3.0.6. The fix adds proper validation and sanitization functions for outgoing response headers, ensuring CRLF sequences are properly handled before being included in HTTP responses.

Workarounds

Implement application-level input validation to strip or reject CRLF sequences from any user data before passing to response headers
Use URL encoding validation on redirect parameters and reject values containing newline characters
Deploy a reverse proxy or WAF in front of the application to filter malicious input patterns
Avoid passing user-controlled data directly into response headers where possible

bash

# Example: Update ewe to patched version
gleam update ewe@3.0.6