The vulnerability arises in the web server’s header encoding routine, where header keys and values are inserted into the raw HTTP response without sanitizing carriage‑return or line‑feed characters. An attacker who can supply arbitrary values for response headers—such as by manipulating a Location header from a user input—can insert CRLF sequences. This results in an HTTP response split, allowing the injection of additional HTTP headers or arbitrary response body content. The injected content may be used for cross‑site scripting or to poison caching proxies. The weakness is a classic response‑splitting flaw. The impact is the potential to exfiltrate data, alter page content seen by users, or redirect clients to malicious sites.

The affected product is the "ewe" web server, maintained by vshakitskiy. All releases prior to version 3.0.6 are vulnerable. Versions 3.0.6 and later include a patch that validates and strips CRLF sequences from outgoing headers.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is remote exploitation via normal HTTP traffic to the server. The exploit requires an attacker to control header values, something feasible when an application propagates user‑controlled data into response headers without sanitization.