CVE-2025-52479 is a high-severity vulnerability in JuliaWeb's HTTP.jl and URIs.jl packages that permits improper neutralization of CRLF sequences (CWE-93). Versions of URIs.jl before 1.6.0 and HTTP.jl before 1.10.17 allow URIs to be constructed with CR/LF characters, enabling CRLF injection attacks if user input is not otherwise sanitized. The fix involves enhanced URI validation incorporated into URI.jl and integrated into HTTP.jl 1.10.17. The vulnerability has a CVSS 4.0 base score of 7.7, indicating a high impact with network attack vector and no required privileges or user interaction.

If exploited, this vulnerability could allow an attacker to inject CRLF characters into HTTP headers or URIs, potentially leading to HTTP response splitting or other injection-based attacks. This may affect the integrity of HTTP communications handled by the vulnerable versions of HTTP.jl and URIs.jl. There are no known exploits in the wild at this time.

A fix is available by upgrading to HTTP.jl version 1.10.17 and URIs.jl version 1.6.0, which include proper URI validation to prevent CRLF injection. As a temporary workaround, users should manually validate and sanitize any URIs before passing them to these packages. Patch status is confirmed by the vendor advisory embedded in the description.