This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| io.jooby:jooby-netty(Maven) | 0 | 2.2.1 | N/A |
CVSS Metrics
