CVE-2024-23644

CVE-2024-23644 describes a request splitting or response splitting vulnerability in Trillium's trillium-http (prior to 0.3.12) and trillium-client (prior to 0.5.4) libraries. This flaw arises from insufficient validation of outbound header values, allowing attackers with control over headers to inject carriage return and newline sequences. The vulnerability carries a CVSS score of 8.1 (HIGH), indicating a network-based attack with high impact on confidentiality, integrity, and availability, though it requires high attack complexity due to the prerequisite of attacker control over header input. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.