Skip to content
OpenAdvisories

Package · Hex

ewe

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.3
    CVE-2026-34715

    ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)

    ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application th…

    vshakitskiy ewe ewe Hex
  • Medium 5.3
    CVE-2026-32881

    ewe has an Overly Permissive List of Allowed Inputs

    ewe is a Gleam web server. ewe is a Gleam web server. Versions 0.6.0 through 3.0.4 are vulnerable to authentication bypass or spoofed proxy-trust headers. Chunked transfer encoding trailer handling merges declared trailer fields into req.headers after body pa…

    vshakitskiy ewe ewe Hex
  • High 7.5
    CVE-2026-32873

    ewe: Loop with Unreachable Exit Condition ('Infinite Loop')

    ewe is a Gleam web server. Versions 0.8.0 through 3.0.4 contain a bug in the handle_trailers function where rejected trailer headers (forbidden or undeclared) cause an infinite loop. When handle_trailers encounters such a trailer, three code paths (lines 520,…

    vshakitskiy ewe ewe Hex