CVE-2024-45687
CVE-2024-45687 is a low-severity vulnerability with a CVSS 4.0 base score of 2.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-113.
Key facts
- Severity: Low (CVSS 4.0 base score 2.4)
- EPSS exploit prediction: 0% (13th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-41751
- Weakness: CWE-113
- Published:
- Last modified:
Description
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.
Frequently asked questions
- What is CVE-2024-45687?
- Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.
- How severe is CVE-2024-45687?
- CVE-2024-45687 has a CVSS 4.0 base score of 2.4, rated low severity.
- Is CVE-2024-45687 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2024-45687?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2024-45687 have an EU (EUVD) identifier?
- Yes. CVE-2024-45687 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-41751.
- When was CVE-2024-45687 published?
- CVE-2024-45687 was published on 2025-01-21 and last updated on 2026-06-17.
References
- https://docs.payara.fish/community/docs/6.2025.1/Release%20Notes/Release%20Notes%206.2025.1.html
- https://docs.payara.fish/enterprise/docs/5.71.0/Release%20Notes/Release%20Notes%205.71.0.html
- https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.22.0.html
Other CWE-113 (HTTP Response Splitting) vulnerabilities
- CVE-2026-38967 — Critical (CVSS 9.8): CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values.
- CVE-2026-34520 — Critical (CVSS 9.1): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser…
- CVE-2025-53007 — High (CVSS 8.9): arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response…
- CVE-2024-52875 — High (CVSS 8.8): An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the…
- CVE-2018-0689 — High (CVSS 8.8): HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to…
- CVE-2018-11347 — High (CVSS 8.8): The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows…
Browse all CWE-113 (HTTP Response Splitting) vulnerabilities →