CVE-2020-15694

Published: Aug 14, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any error if a malicious server provides a negative Content-Length.

Affected (1)

Products: Nim Lang: Nim

Nim Lang

1 product

Nim

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nim Lang Nim	Up to 1.2.6

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

http://www.openwall.com/lists/oss-security/2021/02/04/2

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://consensys.net/diligence/vulnerabilities/nim-httpclient-header-crlf-injection/

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/httpclient.nim#L241

Source: cve@mitre.org

PatchThird Party Advisory

https://nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html

Source: cve@mitre.org

Release NotesThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/02/04/2

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://consensys.net/diligence/vulnerabilities/nim-httpclient-header-crlf-injection/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/httpclient.nim#L241

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

Timeline

No history available yet.