CVE-2016-1133: CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x...

Security readout for executives and security teams

CVE-2016-1133 affects the H2O web server redirect handler. A remote user could craft a URI that causes unintended HTTP headers to be added to the response. For an internet-facing service, this can undermine response integrity and may support HTTP response splitting attacks. Exposure is most likely where H2O is deployed as a public web server or reverse-facing service on affected versions. The source bundle does not provide CPEs or distribution packaging details, so teams must confirm H2O usage and version through asset inventory. Address during normal vulnerability remediation, with faster handling for public H2O services. The issue is remotely triggerable, but the bundle provides no CVSS score, no KEV entry, and no evidence of active exploitation. Mitigation focus: Upgrade H2O to 1.6.2, 1.7.0-beta3, or a later supported release.; Check the H2O vulnerability notice and project issues for vendor-specific guidance.; Prioritize internet-facing H2O services before internal-only instances..

Prepared

Jun 13, 2026, 21:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.