Drogon is a C++ web framework that presents a narrow but strategically positioned attack surface through its single core product; vulnerabilities concentrate in access-control and input-handling weaknesses including improper pathname restrictions, CRLF injection, HTTP request/response splitting, and broader injection classes that reflect the parsing and request-dispatch logic of a web server component. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Drogon over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-35397HIGH A path traversal vulnerability in the static router for Drogon from 1.0.0-beta14 to 1.6.0 could allow an unauthenticated, remote attacker to arbitrarily read files. The vulnerabili | Aug 4, 2021 | 7.5 | 25 | NO | NO |
CVE-2022-25297HIGH This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to a | Feb 21, 2022 | 8.8 | 22 | NO | NO |
CVE-2023-26137MEDIUM All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie | Jul 6, 2023 | 6.1 | 20 | NO | NO |
CVE-2022-3959MEDIUM A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the component Session Hash Handl | Nov 11, 2022 | 5.3 | 20 | NO | NO |
CVE-2023-26138MEDIUM All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers in the addHeader function. An attacker | Jul 6, 2023 | 4.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Drogon.
Media articles that mention a CVE ID that affects a product developed by Drogon — matched by CVE ID, not by vendor name.