CVE-2008-3906 json
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP r…
published 2008-09-04 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-3892
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.1%
- EPSS 7.1% chance of exploitation in 30 days, percentile 94%
- public exploits
- 1
- Exploit-DB
Summary
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
Patch / fix
- mono Debian 14, Debian 13, Debian 12 1.9.1+dfsg-4
debian advisories DEBIAN-CVE-2008-3906
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2008-3906 updated
mono: Sys.Web HTTP header injection attack
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (EDB-32303)
- Published
Exploit prediction
7.10% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-32303 Mono 2.0 - 'System.Web' HTTP Header Injection remote, 2008-08-20
- securityfocus.com http://www.securityfocus.com/bid/30867 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
securityfocus.com
/bid/30867
vdb-entry, exploit
-
usn.ubuntu.com
/826-1/
vendor-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2008:210
vendor-advisory
-
secunia.com
/advisories/31643
third-party-advisory, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/44740
vdb-entry
-
secunia.com
/advisories/36494
third-party-advisory
-
openwall.com
/lists/oss-security/2008/08/27/6
mailing-list
-
vupen.com
/english/advisories/2008/2443
vdb-entry
-
securityfocus.com
/archive/1/496845/100/0/threaded
mailing-list
- wiki.rpath.com /wiki/Advisories:rPSA-2008-0286
- bugzilla.novell.com /show_bug.cgi?id=418620
Sources
- CVE List CVE-2008-3906
- NVD CVE-2008-3906
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.