Low
Security advisory
CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via newline characters in a filename.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-1900
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:08 UTC · Revision 1
Source evidence
CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via newline characters in a filename.
osv:CVE-2016-1900
Complete source record
{
"id": "de852637d9588e997da10f414c8242f0c6fe3395f11bf488d85886c1a43d17a7",
"url": "https://osv.dev/vulnerability/CVE-2016-1900",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-1900",
"summary": "CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via newline characters in a filename.",
"evidence": "osv:CVE-2016-1900",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2016-1900",
"aliases": [
"CVE-2016-1900"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.zx2c4.com/cgit",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "cadbb69990d232ce49547190b1cff2b57fc8b438"
},
{
"fixed": "513b3863d999f91b47d7e9f26710390db55f9463"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:cgit_project:cgit:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.11.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "513b3863d999f91b47d7e9f26710390db55f9463"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v0.11.2",
"v0.11.1",
"v0.11.0",
"v0.10.2",
"v0.10.1",
"v0.10",
"v0.9.2",
"v0.9.1",
"v0.9",
"v0.8.3",
"v0.8.2",
"v0.8.1",
"v0.8",
"v0.7",
"v0.6.3",
"v0.6.2",
"v0.6.1",
"v0.6",
"v0.5",
"v0.4",
"v0.3",
"v0.2",
"v0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1900.json",
"vanir_signatures": [
{
"id": "CVE-2016-1900-2a16d71d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303635134559780235920602479049562748628",
"268029137398368228895866990574732411445",
"238148945285719645881734013997579473124",
"161613218865791216369151868169239121144"
]
},
"source": "https://git.zx2c4.com/cgit@513b3863d999f91b47d7e9f26710390db55f9463",
"target": {
"file": "html.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-1900-6d73d14e",
"digest": {
"length": 1089,
"function_hash": "332491374332546430843719618893626928978"
},
"source": "https://git.zx2c4.com/cgit@513b3863d999f91b47d7e9f26710390db55f9463",
"target": {
"file": "ui-shared.c",
"function": "cgit_print_http_headers"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-1900-f391dad3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280853181015064525992207757317778338098",
"2445699724713834896364786767072858261",
"333801533415353928040247592516687827248",
"246362227111271641823560225534250708303",
"36085700276502553116015216949278302173",
"125375886728632254251014709506464421448"
]
},
"source": "https://git.zx2c4.com/cgit@513b3863d999f91b47d7e9f26710390db55f9463",
"target": {
"file": "ui-shared.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:12:42Z"
}
}
],
"modified": "2026-10-20T13:12:42.197514903Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "22"
},
{
"last_affected": "22"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-1900",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387301,
"published_at": "2016-01-20T16:59:04.91+00:00"
}