What is GHSA-xm2q-h8v9-r8j8?

GHSA-xm2q-h8v9-r8j8 is a security advisory published by GitHub Security Advisories with Low severity. An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')...

Which CVE IDs does GHSA-xm2q-h8v9-r8j8 cover?

GHSA-xm2q-h8v9-r8j8 covers the following CVE IDs: CVE-2025-62826. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xm2q-h8v9-r8j8?

GHSA-xm2q-h8v9-r8j8 has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

GHSA-xm2q-h8v9-r8j8LowCVSS 3.1

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')...

Vendor

GitHub Security Advisories

Published

July 14, 2026

Last Modified

July 14, 2026

🔗 CVE IDs covered (1)

CVE-2025-62826 →

📋 Description

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker able to intercept and modify a user's captive portal authentication request to inject arbitrary headers via crafted HTTP requests.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-62826
https://fortiguard.fortinet.com/psirt/FG-IR-26-153
https://github.com/advisories/GHSA-xm2q-h8v9-r8j8