Critical CRLF Injection Vulnerability in Gakido HTTP Client Library (CVE-2026-24489) A critical vulnerability in Gakido, an HTTP client library developed by HappyHackingSpace, has been disclosed, allowing attackers to inject arbitrary HTTP headers via CRLF (Carriage Return Line Feed) sequences. Tracked as CVE-2026-24489 (advisory RO-26-005), the flaw affects all versions of Gakido prior to 0.1.1-1bc6019 and carries a medium severity rating. The vulnerability stems from insufficient input validation in the `canonicalize_headers()` function within `gakido/headers.py`. When user-controlled header values containing CRLF sequences (`\r\n`), line feeds (`\n`), or null bytes (`\x00`) are passed to Gakido’s request methods, the library fails to sanitize them before transmission. This enables attackers to inject malicious headers into legitimate HTTP requests, compromising communication integrity. Exploitation of this flaw can lead to multiple high-impact attack vectors, including: - Unauthorized header injection in HTTP requests. - HTTP response manipulation via proxy configurations. - Cache poisoning through injected cache-control headers. - Session fixation by bypassing server-side security controls. A proof of concept demonstrates the simplicity of exploitation. By crafting a `User-Agent` header with embedded CRLF sequences (e.g., `"test\r\nX-Injected: pwned"`), attackers can inject arbitrary headers into requests sent through the library. The vulnerability was reported on January 25, 2026, and publicly disclosed on January 27, 2026, prompting an immediate patch release (version 0.1.1-1bc6019). Organizations using Gakido in production environments particularly those handling sensitive HTTP communications or accepting user-supplied headers are urged to upgrade to the patched version to mitigate risks. Technical details and the complete fix are available via the GitHub advisory (GHSA-gcgx-chcp-hxp9) and the corresponding commit (369c67e). The incident underscores the critical need for input sanitization in HTTP client libraries, especially those handling network primitives.