AIKIDO-2026-11009

TL;DR

The package fixed a CRLF header injection vulnerability in SseHttpTransport::buildHeaderString(), where header names and values were previously concatenated into the HTTP header block without filtering carriage return or line feed characters. If an attacker can control any portion of the headers passed into this method, they may inject forged headers or manipulate the request structure by inserting additional header lines. In practice, this could be exploited to smuggle unintended metadata, override security-relevant headers, or potentially alter downstream request handling, depending on how the transport is used and what intermediaries process the resulting request.