CVE-2026-0865

CVE-2026-0865 describes a vulnerability where user-controlled HTTP header names and values containing newlines can lead to HTTP header injection. While specific affected products are not detailed, the issue stems from improper input validation. This vulnerability carries a CVSS 4.0 score of 5.9 (MEDIUM), indicating a network-based attack with low attack complexity, requiring high privileges to exploit. A successful exploit could lead to high integrity impact, allowing an attacker to manipulate HTTP requests or responses. There is currently no evidence of active exploitation (KEV: No), nor are there public Metasploit or Nuclei modules. However, the vulnerability has garnered significant community attention with 14 mentions and 3 media articles, suggesting awareness and potential for future exploit development.