AIKIDO-2026-81574

aiosonic is vulnerable to HTTP Header Injection

HTTP Header InjectionGHSA-86v3-rrw9-q5mg Published Jul 27, 2026

Medium Risk

This Affects:

aiosonic

0.0.1 - 1.0.2

Fixed in 1.0.3

Are you affected? Scan for Free

TL;DR

aiosonic serializes outbound HTTP/1.1 request headers by interpolating caller-supplied header names and values directly into the request bytes with no validation of either token. When an application places attacker-influenced input into a header value, carriage-return/line-feed sequences reach the wire unmodified, allowing injection of arbitrary additional headers and even a complete second pipelined request on the same connection. This enables header injection, request splitting/smuggling, cache poisoning, and SSRF-style requests to upstream-reachable paths. The fix adds an http_parser.validate_header() check that rejects illegal header tokens and CR/LF characters, enforced in add_header() and the WebSocket handshake.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application places attacker-influenced input into an outbound request header name or value.