A flaw in Gakido before version 0.1.1 permits the injection of arbitrary HTTP headers when user‑supplied header names or values contain CRLF, LF, or null bytes. The client builds raw HTTP requests, so a crafted header can be inserted and sent to the target server, altering the semantics of the request or enabling header‑based attacks such as request smuggling or bypassing security checks performed downstream.

HappyHackingSpace’s Gakido HTTP client is affected in all releases prior to v0.1.1. The issue was fixed in the 0.1.1 release and later versions.

The CVSS score of 5.3 indicates medium severity. The EPSS score is below 1%, signifying a low probability of exploitation at the time of analysis. The vulnerability is not listed in the KEV catalog. Based on the description, it is inferred that the primary attack vector involves an application supplying user‑controlled header names or values to Gakido. The injected headers can modify request flow but there is no evidence of code‑execution or higher‑level compromise. Overall, the risk is limited to integrity impacts of the HTTP requests.