Homepage

HTTP Response Splitting The advisory has been revoked - it doesn't affect any version of package opensearch-3-ml-commons  (opens in a new tab)

Threat Intelligence

EPSS
1.07% (65th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-OPENSEARCH3MLCOMMONS-16707202
  • published16 May 2026
  • disclosed13 May 2026
Report a new vulnerability Found a mistake?

Introduced: 13 May 2026

CVE-2026-42578  (opens in a new tab)
CWE-113  (opens in a new tab)

Amendment

The Minimos security team deemed this advisory irrelevant for Minimos:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream opensearch-3-ml-commons package and not the opensearch-3-ml-commons package as distributed by Minimos.

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

References