CVE-2026-24489: Gakido HTTP Header Injection Vulnerability
Summary
CVE-2026-24489: Gakido vulnerable to HTTP Header Injection (CRLF Injection). Affects gakido versions < 0.1.1. Fixed in 0.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Gakido is a Python-based HTTP client library designed for making HTTP requests in a simple and efficient manner. It allows developers to easily send GET and POST requests while managing headers and responses. However, a critical vulnerability has been identified that exposes Gakido to HTTP Header Injection, specifically through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names.
Vulnerability Detail
The vulnerability arises from the lack of proper sanitization of user-controlled header values in Gakido's request methods. Attackers can exploit this flaw by injecting CRLF sequences, allowing them to add arbitrary HTTP headers to requests. This can lead to several serious consequences, including HTTP response splitting, cache poisoning, session fixation, and bypassing security controls. The affected code is located in the header processing logic within the 'gakido/headers.py' file, specifically in the 'canonicalize_headers()' function.
How To Fix
Minimum fixed version
0.1.1
This is the first release that contains the fix.
pip install --upgrade "gakido==0.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround involves manually sanitizing header values before passing them to Gakido's request methods. For example, you can implement a simple sanitization function as follows:
def sanitize_header(name: str, value: str) -> tuple[str, str]:
clean_name = name.replace('\r', '').replace('\n', '').replace('\x00', '')
clean_value = value.replace('\r', '').replace('\n', '').replace('\x00', '')
return clean_name, clean_value
Usage:
header_name, header_value = sanitize_header('User-Agent', 'test\r\nX-Injected: pwned')
Conclusion
The Gakido HTTP Header Injection vulnerability (CVE-2026-24489) poses significant risks to applications using this library. It is crucial for developers to update to the patched version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for gakido →
FAQ
The vulnerability allows HTTP Header Injection through CRLF sequences in user-supplied header values, enabling attackers to inject arbitrary headers.
Potential impacts include HTTP response splitting, cache poisoning, session fixation, and bypassing security controls.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update Gakido to version 0.1.1 or later using the command 'pip install --upgrade gakido'.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
