[GHSA-f97h-2pfx-f59f] HTTP response splitting in uvicorn - #9304
[GHSA-f97h-2pfx-f59f] HTTP response splitting in uvicorn#9304hamedrabah wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
The added references accurately document the vulnerability and its fix, with no unresolved issues.
Pull request overview
Updates the uvicorn advisory with authoritative upstream fix references and current severity metadata.
Changes:
- Removes the CVSS v3 vector while retaining CVSS v4.
- Adds upstream issue, pull request, and fix commit references.
- Updates the modification timestamp.
File summaries
| File | Description |
|---|---|
GHSA-f97h-2pfx-f59f.json |
Updates severity and vulnerability references. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
I reviewed the generated diff again. The three upstream references are the intended improvement. The diff also removes the existing CVSS v3 vector, which is not needed for that change. Please preserve the existing CVSS v3 entry alongside CVSS v4 when curating this contribution; I am not proposing a severity reassessment. The contribution branch is in the github organization, so I cannot amend it directly from my fork. |
Updates
Comments
Add authoritative upstream evidence for the vulnerability and its fix. Uvicorn issue #719 documents the HTTP response splitting report; pull request #725 was merged to close it; and commit 731076ae6d9c11201442f3711488ae191253ce31 changes HEADER_RE in uvicorn/protocols/http/httptools_impl.py to reject invalid header characters, supporting the patched version 0.11.7.