5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24489

CVE-2026-24489: Gakido vulnerable to HTTP Header Injection (CRLF Injection)

Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allowed HTTP header injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header values and names. When making HTTP requests with user-controlled header values containing \r\n (CRLF), \n (LF), or \x00 (null byte) characters, an attacker could inject arbitrary HTTP headers into the request. The fix in version 0.1.1 adds a _sanitize_header() function that strips \r, \n, and \x00 characters from both header names and values before they are included in HTTP requests.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24489

CVE-2026-24489:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gakido	pip	< 0.1.1	0.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the gakido/headers.py file, specifically within the canonicalize_headers function. The function's purpose is to merge and order default and user-provided HTTP headers. Before the patch, the function directly processed header names and values from the user_headers dictionary and default_headers iterable without any sanitization. This allowed for CRLF injection, as demonstrated in the proof of concept, where a User-Agent header containing \r\n could be used to inject a new X-Injected header. The fixing commit 369c67e67c63da510c8a9ab021e54a92ccf1f788 addresses this by introducing a _sanitize_header function that strips carriage returns, line feeds, and null bytes from both header names and values. This sanitization is now applied to every header within canonicalize_headers, effectively mitigating the header injection vulnerability. Therefore, canonicalize_headers is the direct vulnerable function as it was the one processing the malicious input.

Vulnerable functions

canonicalize_headers

gakido/headers.py

The `canonicalize_headers` function was vulnerable because it processed header names and values from `user_headers` and `default_headers` without sanitizing them. This allowed an attacker to inject CRLF sequences (`\r\n`) and other control characters into the headers of an HTTP request, leading to HTTP Header Injection. The function would iterate through the user-provided headers and use them as-is, making it possible to split headers and introduce new, malicious ones.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.