Details of VAR-202604-1913

ID

VAR-202604-1913

CVE

CVE-2026-31908

TITLE

Apache Software Foundation of APISIX Vulnerability in sanitizing special elements in

Trust: 0.8

sources: JVNDB: JVNDB-2026-011615

DESCRIPTION

Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue. 3.16.0 It is recommended to upgrade to .All information handled by the software may be leaked to the outside. All information handled by the software may be rewritten. Furthermore, the software will not stop. Furthermore, attacks that exploit this vulnerability will not affect other software

Trust: 1.62

sources: NVD: CVE-2026-31908 // JVNDB: JVNDB-2026-011615

AFFECTED PRODUCTS

vendor:	apache	model:	apisix	scope:	lt	version:	3.16.0	Trust: 1.0
vendor:	apache	model:	apisix	scope:	gte	version:	2.12.0	Trust: 1.0
vendor:	apache	model:	apisix	scope:	-	version:	-	Trust: 0.8
vendor:	apache	model:	apisix	scope:	eq	version:	-	Trust: 0.8
vendor:	apache	model:	apisix	scope:	eq	version:	2.12.0 that's all 3.16.0	Trust: 0.8

sources: JVNDB: JVNDB-2026-011615 // NVD: CVE-2026-31908

CVSS

SEVERITY

CVSSV2

CVSSV3

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2026-31908
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2026-011615
value:	CRITICAL
Trust: 0.8

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2026-31908
baseSeverity:	CRITICAL
baseScore:	9.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	5.2
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2026-011615
baseSeverity:	CRITICAL
baseScore:	9.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2026-011615 // NVD: CVE-2026-31908

PROBLEMTYPE DATA

problemtype:	CWE-75	Trust: 1.0
problemtype:	Inappropriate sanitizing of special elements (CWE-75) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2026-011615 // NVD: CVE-2026-31908

PATCH

title:

Apache APISIX

url:

https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b

Trust: 0.8

sources: JVNDB: JVNDB-2026-011615

EXTERNAL IDS

db:	NVD	id:	CVE-2026-31908	Trust: 2.6
db:	OPENWALL	id:	OSS-SECURITY/2026/04/14/3	Trust: 1.0
db:	JVNDB	id:	JVNDB-2026-011615	Trust: 0.8

sources: JVNDB: JVNDB-2026-011615 // NVD: CVE-2026-31908

REFERENCES

url:	https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6b	Trust: 1.0
url:	http://www.openwall.com/lists/oss-security/2026/04/14/3	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2026-31908	Trust: 0.8

sources: JVNDB: JVNDB-2026-011615 // NVD: CVE-2026-31908

SOURCES

db:	JVNDB	id:	JVNDB-2026-011615
db:	NVD	id:	CVE-2026-31908

LAST UPDATE DATE

2026-06-19T23:19:13.263000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2026-011615	date:	2026-04-20T01:52:00
db:	NVD	id:	CVE-2026-31908	date:	2026-04-17T18:40:12.787

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2026-011615	date:	2026-04-20T00:00:00
db:	NVD	id:	CVE-2026-31908	date:	2026-04-14T09:16:35.650