hex ewe vulnerabilities

Latest hex ewe CVEs

Newest publication first

1. CVE-2026-34715 ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)

   Published 2026-04-02

   Medium·CVSS 5.3 EPSS 0.34%

   ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-contro...

2. CVE-2026-32881 ewe has an Overly Permissive List of Allowed Inputs

   Published 2026-03-20

   Medium·CVSS 5.3 EPSS 0.40%

   ewe is a Gleam web server. ewe is a Gleam web server. Versions 0.6.0 through 3.0.4 are vulnerable to authentication bypass or spoofed proxy-trust headers. Chunked transfer encoding trailer handling merges declared trailer fields into req.headers after body parsing, but the denyli...

3. CVE-2026-32873 ewe: Loop with Unreachable Exit Condition ('Infinite Loop')

   Published 2026-03-20

   High·CVSS 7.5 EPSS 0.62%

   ewe is a Gleam web server. Versions 0.8.0 through 3.0.4 contain a bug in the handle_trailers function where rejected trailer headers (forbidden or undeclared) cause an infinite loop. When handle_trailers encounters such a trailer, three code paths (lines 520, 523, 526) recurse wi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.