Vulnerabilities
Products Security index
Vulnerabilities
CVE-2026-105144
Drogon Static File Router StaticFileRouter.cc route path traversal
CVE-2026-94144
drogonframework drogon ORM Criteria.cc makeCriteria sql injection
CVE-2026-94143
drogonframework drogon ORM Mapper Mapper.h orderBy sql injection
CVE-2023-26137
All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.
CVE-2023-26138
All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers in the addHeader function. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.
