The flaw lies in the encode_headers function of the web server, which inserts header keys and values directly into the HTTP bytes without removing CRLF ( \n) sequences. Because of this, an attacker who can supply arbitrary data to a response header—such as setting a Location redirect header from a request parameter—can inject extra CRLFs. This allows the attacker to break the intended response structure and inject additional HTTP content, leading to HTTP response splitting, cache poisoning, and, depending on the context, cross‑site scripting. The weakness corresponds to the Common Weakness Enumeration item CWE‑113: Improper Neutralization of CRLF Sequences.

The vulnerability affects the web server software named ewe, developed by vshakitskiy. All releases prior to version 3.0.6 are susceptible because they use the unguarded encoder function. The patch that fixes the issue is included in the 3.0.6 release.

The Common Vulnerability Scoring System assigns a score of 5.3, indicating a moderate severity. The Exploit Prediction Scoring System score is not available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is remote, requiring the ability to send specially crafted HTTP requests to the vulnerable server. No privileged access is needed; an attacker can simply send a request containing a header value with CRLF characters to trigger the vulnerability. Once exploited, the attacker can interfere with client browsers, manipulate cache entries, or embed malicious scripts, depending on the header context.