CVE-2020-6858: 
Java vulnerability analysis and mitigation

Hotels Styx through version 1.0.0.beta8 was found to be vulnerable to HTTP response splitting due to CRLF Injection (CVE-2020-6858). The vulnerability was discovered and disclosed in February 2020, affecting the HTTP header handling components of the software (GitHub Advisory).

The vulnerability exists in the com.hotels.styx.api.HttpHeaders.Builder component and StyxToNettyResponseTranslator due to disabled HTTP Header validation built into Netty. The issue stems from using 'new DefaultHttpHeaders(false)' and 'new DefaultHttpResponse(version, httpResponseStatus, false)' which explicitly disables the built-in validation in Netty. The vulnerability was identified through a Semmle QL project query (GitHub Advisory).

The vulnerability allows for HTTP response splitting attacks if untrusted user input can appear in a response header. This could potentially lead to security issues related to response manipulation (GitHub Advisory).

The vulnerability has been patched in version 1.0.0-rc1 and later. The recommended fix is to either use the default constructor or explicitly enable header validation by using 'new DefaultHttpHeaders(true)' and 'new DefaultHttpResponse(version, httpResponseStatus, true)' (GitHub Advisory).