CVE-2026-50576
Received Received - Intake

HTTP Header Injection in ePA 3.x Integration

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The build_inner_header function interpolates the uri, host, accept_type, content_type, content_length, USER_AGENT, and insurant_id values into request lines and headers, including x-useragent and x-insurantid. An authenticated attacker who controls a value can inject additional headers into the inner request. Depending on ePA server handling, an injected x-insurantid header can expose another patient's records, and injected Authorization headers can bypass the intended authentication or authorization context. Session-derived USER_AGENT input can also poison requests across the session. This issue is fixed in version 1.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-50576
EUVD
EUVD-2026-61054

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fbeta-gmbh epa3-service-opensource to 1.3.0 (exc)
fbeta-gmbh epa3-service-opensource 1.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50576 is an HTTP Header Injection vulnerability in the ePA3-Service-OpenSource software affecting versions prior to 1.3.0. It occurs when unsanitized CRLF characters are injected into internally constructed HTTP requests within the VAU channel. Attackers can manipulate values like x-insurantid or Authorization headers to expose patient records, bypass authentication, or poison requests across sessions.

Detection Guidance

To detect this vulnerability, inspect HTTP requests generated by ePA 3.x Integration versions prior to 1.3.0 for unsanitized CRLF characters in headers like x-insurantid, Authorization, or USER_AGENT. Check for duplicate headers or unexpected header injections in VAU inner requests. Use tools like Wireshark or tcpdump to capture and analyze HTTP traffic for malformed headers.

Impact Analysis

An authenticated attacker could inject headers to access another patient's records by manipulating the x-insurantid header. They could also bypass authentication or authorization by injecting Authorization headers. Session-wide header poisoning is possible by controlling inputs like USER_AGENT, potentially leading to request smuggling or data leaks.

Compliance Impact

This vulnerability could lead to unauthorized access to patient records, violating GDPR's data protection principles and HIPAA's privacy rules. It may result in data breaches, non-compliance with confidentiality requirements, and potential legal penalties for organizations failing to protect sensitive health information.

Mitigation Strategies

Immediately upgrade ePA 3.x Integration to version 1.3.0 or later. Implement input validation for insurant IDs and USER_AGENT values at the application boundary. Sanitize all user-controlled header values to remove CRLF characters before processing. Monitor HTTP requests for suspicious header injections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart