CVE-2019-17513 json
io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection')
published 2019-10-18 7 y ago modified 2026-07-08 4 mo ago also GHSA-mvqp-q37c-wf9j , EUVD-2019-0708
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
Patch / fix
- maven io.ratpack:ratpack-core 1.7.5
- ratpack_project ratpack 1.7.5
Exploit prediction
2.15% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.ratpack:ratpack-core | <1.7.5 |
1.7.5 |
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
-
github.com
/ratpack/ratpack/commit/efb910d38a96494256f36675ef0e5061097dd77d
web, patch
-
github.com
/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23ae
web, patch
-
ratpack.io
/versions/1.7.5
web, vendor-advisory
-
github.com
/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j
web, third-party-advisory
-
github.com
/ratpack/ratpack/releases/tag/v1.7.5
web, release-notes, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2019-17513
advisory
-
github.com
/advisories/GHSA-mvqp-q37c-wf9j
advisory
-
github.com
/ratpack/ratpack
package
Sources
- CVE List CVE-2019-17513
- GitHub Advisory GHSA-mvqp-q37c-wf9j
- NVD CVE-2019-17513
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.