Vulnerability advisory

CVE-2020-35669

Published Dec 24, 2020Updated Oct 20, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/dart-lang/http ↗
All commits through ba03ec18c34bc253d285076f9cc3d6e4a436b84e	No fix listed
Also listed as affected (25) `0.12.2` `0.12.1` `0.12.0+4` `0.12.0+3` `0.12.0+2` `0.12.0` `0.11.3+17` `0.11.3+16` `0.11.3+15` `0.11.3+14` `0.11.3+13` `0.11.3+12` `0.11.3+11` `0.11.3+10` `0.11.3+9` `0.11.3+8` `0.11.3+7` `0.11.3+6` `0.11.3+5` `0.11.3+4` `0.11.3+3` `0.11.3+2` `0.11.3+1` `0.11.3` `0.11.2`

Description

An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.

References

Advisorygithub.com/dart-lang/http/blob/master/CHANGELOG.md#0133 ↗
Fixgithub.com/dart-lang/http/issues/511 ↗