CVSS 3.1 Score 8.1 of 10 (high)


Published Jan 24, 2024
Updated: Feb 2, 2024
CWE ID 436
CWE ID 113


CVE-2024-23644 is a cyber vulnerability that affects the Trillium toolkit for building internet applications with async rust. Specifically, the vulnerability exists in trillium-http prior to version 0.3.12 and trillium-client prior to version 0.5.4. Attackers who have control over headers can exploit this vulnerability by inserting "\r\n" sequences, leading to request splitting or response splitting attacks. The lack of validation of outbound header values allows attackers to gain control over other parts of requests or responses, potentially compromising the organization's network security. The base severity of this vulnerability is rated as HIGH according to the National Vulnerability Database (NVD). To remediate this issue, it is recommended to update to the latest versions of trillium-http and trillium-client.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-23644 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options