CVE-2008-3906

CVE-2008-3906 describes a CRLF injection vulnerability in Sys.Web within Mono 2.0 and earlier versions. This flaw allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting attacks by embedding CRLF sequences in the query string. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity, requiring no authentication, and primarily impacting integrity. While not listed in CISA's KEV catalog, exploit code for this vulnerability is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.