CVE-2025-53007 – arduino-esp32 vulnerable to CRLF injection in WebServer.cpp

https://notcve.org/view.php?id=CVE-2025-53007

26 Jun 2025 — arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability. The `sendHeader` function takes arbitrary input for the HTTP header name and value, concatenates them into an HTTP header line, and appends this to the outgoing HTTP response headers. There is no validation or sanitization of the `name` or `value` parameters before they are included in the HTTP response. If an attacker can control the input to `sendHeader` (either dire... • https://github.com/espressif/arduino-esp32/security/advisories/GHSA-5476-9jjq-563m • CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') •