CVE-2026-24489: Gakido vulnerable to HTTP Header Injection (CRLF Injection)
(updated )
A vulnerability was discovered in Gakido that allowed HTTP Header Injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names.
When making HTTP requests with user-controlled header values containing \r\n (CRLF), \n (LF), or \x00 (null byte) characters, an attacker could inject arbitrary HTTP headers into the request.
References
- github.com/HappyHackingSpace/gakido
- github.com/HappyHackingSpace/gakido/commit/369c67e67c63da510c8a9ab021e54a92ccf1f788
- github.com/HappyHackingSpace/gakido/releases/tag/v0.1.1-1bc6019
- github.com/HappyHackingSpace/gakido/security/advisories/GHSA-gcgx-chcp-hxp9
- github.com/advisories/GHSA-gcgx-chcp-hxp9
- nvd.nist.gov/vuln/detail/CVE-2026-24489
Code Behaviors & Features
Detect and mitigate CVE-2026-24489 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →