{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-04T14:53:46.942","vulnerabilities":[{"cve":{"id":"CVE-2026-24489","sourceIdentifier":"security-advisories@github.com","published":"2026-01-27T01:16:02.453","lastModified":"2026-06-17T10:23:08.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allowed HTTP header injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names. When making HTTP requests with user-controlled header values containing `\\r\\n` (CRLF), `\\n` (LF), or `\\x00` (null byte) characters, an attacker could inject arbitrary HTTP headers into the request. The fix in version 0.1.1 adds a `_sanitize_header()` function that strips `\\r`, `\\n`, and `\\x00` characters from both header names and values before they are included in HTTP requests."},{"lang":"es","value":"Gakido es un cliente HTTP de Python centrado en la suplantación de navegadores y la evasión de bots. Se descubrió una vulnerabilidad en Gakido anterior a la versión 0.1.1 que permitía la inyección de encabezados HTTP a través de secuencias CRLF (retorno de carro y salto de línea) en los valores y nombres de los encabezados proporcionados por el usuario. Al realizar solicitudes HTTP con valores de encabezado controlados por el usuario que contienen caracteres `\\r\\n` (CRLF), `\\n` (LF) o `\\x00` (byte nulo), un atacante podía inyectar encabezados HTTP arbitrarios en la solicitud. La corrección en la versión 0.1.1 añade una función `_sanitize_header()` que elimina los caracteres `\\r`, `\\n` y `\\x00` tanto de los nombres como de los valores de los encabezados antes de que se incluyan en las solicitudes HTTP."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"HappyHackingSpace","product":"gakido","versions":[{"version":"< 0.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-27T14:46:28.507941Z","id":"CVE-2026-24489","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-93"},{"lang":"en","value":"CWE-113"}]}],"references":[{"url":"https://github.com/HappyHackingSpace/gakido/commit/369c67e67c63da510c8a9ab021e54a92ccf1f788","source":"security-advisories@github.com"},{"url":"https://github.com/HappyHackingSpace/gakido/releases/tag/v0.1.1-1bc6019","source":"security-advisories@github.com"},{"url":"https://github.com/HappyHackingSpace/gakido/security/advisories/GHSA-gcgx-chcp-hxp9","source":"security-advisories@github.com"}]}}]}