CVE-2016-1133: Dena h2o

Low severity, CVSS 3.7. EPSS: 1.5% chance of exploitation in the next 30 days.

CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI.

Affected products

• Dena h2o: up to and including 1.6.1; version 1.7.0 only

Published 2016-01-16. Last modified 2026-06-17.