Improper neutralization of carriage-return, line-feed sequences in HTTP headers allows a remote client to inject arbitrary header lines when an application passes request-derived data into header values or redirect URLs. The injected headers can split the HTTP response, enabling header injection that may facilitate phishing or service disruption.

Apache Software Foundation’s Apache Juneau REST framework, through version 9.2.0, is affected. The flaw is triggered only when application code assigns request-derived values to response headers or redirect targets; the framework itself does not build such values by default.

With a CVSS score of 10, the flaw is rated as critical and has a high likelihood of exploitation in environments where applications utilize request data for headers or redirects. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the vulnerability remotely via crafted HTTP requests that contain CRLF sequences; because the servlet container does not reject such sequences, the injected header lines are transmitted to the client. Successful exploitation can lead to open-redirect attacks, phishing, or further attacks that leverage the split response.