CVE-2019-17513: io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection')
Summary
CVE-2019-17513: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') Versions of Ratpack 0.9.1 through and including 1.7.4 are vulnerable to HTTP Response Splitting, if untrusted and unsanitized... Affects io.ratpack:ratpack-core versions < 1.7.5. Fixed in 1.7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ratpack is an open-source framework for building reactive, non-blocking web applications in Java. It provides a simple and expressive API for handling HTTP requests and responses. The ratpack-core package is a core component of Ratpack that includes essential functionality for handling HTTP requests and responses. Unfortunately, versions 0.9.1 through 1.7.4 of ratpack-core are vulnerable to an injection attack known as Improper Neutralization of Special Elements in Output ('Injection'). This vulnerability allows an attacker to manipulate the headers of an HTTP response, potentially leading to cross-user defacement, cache poisoning, cross-site scripting, and page hijacking.
Vulnerability Detail
The vulnerability in ratpack-core arises from the improper handling of user-supplied data used to populate response headers. If untrusted and unsanitized data is used as a value for a response header, an attacker can exploit this vulnerability to have the server issue any HTTP response they specify. Previously, Ratpack did not validate response header values, allowing malicious input to be injected into the headers. However, in the patched version 1.7.5, adding a header value that contains the header value termination characters (CRLF) will produce a runtime exception, preventing the injection of malicious content. It is still recommended to validate and sanitize user-supplied values used as response headers to mitigate any potential risks.
How To Fix
Latest published version: 2.0.0-rc-1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the ratpack-core package is not immediately feasible, a workaround for this vulnerability is to ensure that any user-supplied values used as response headers are properly validated and sanitized to exclude carriage return and line feed characters. This can be achieved by implementing input validation and sanitization routines in the application code that handles the construction of response headers.
Conclusion
The vulnerability in io.ratpack:ratpack-core exposes applications to the risk of injection attacks, potentially leading to cross-user defacement, cache poisoning, cross-site scripting, and page hijacking. To mitigate this risk, it is crucial to update the ratpack-core package to version 1.7.5 or later. Additionally, implementing input validation and sanitization routines for user-supplied values used as response headers can provide an interim workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.ratpack:ratpack-core →
FAQ
The impact of this vulnerability includes cross-user defacement, cache poisoning, cross-site scripting, and page hijacking. An attacker can manipulate the headers of an HTTP response, potentially altering the content displayed to users or injecting malicious scripts.
Versions 0.9.1 through 1.7.4 of ratpack-core are vulnerable to this injection attack. It is recommended to update to version 1.7.5 or later to mitigate the risk.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file to analyze the dependencies.
While there are no known public exploits specifically targeting this vulnerability in ratpack-core, it is still crucial to update to the patched version to prevent potential attacks.
In addition to updating the ratpack-core package, it is essential to follow secure coding practices, including input validation and sanitization, to mitigate the risk of injection attacks. Regularly monitoring for security updates and applying them promptly is also recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.ratpack:ratpack-core.
