CVE-2026-27810: 
NixOS vulnerability analysis and mitigation

CVE-2026-27810 is an HTTP Response Header Injection (HTTP Response Splitting) vulnerability in the calibre Content Server, a feature of the cross-platform e-book manager calibre. The vulnerability allows any authenticated user to inject arbitrary HTTP headers into server responses via an unsanitized content_disposition query parameter in the /get/ and /data-files/get/ endpoints. All calibre versions up to and including 9.3.1 are affected; version 9.4.0 contains the fix. It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory).

The root cause is CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers / HTTP Response Splitting). The book_fmt() function in src/calibre/srv/content.py (lines 224–226) and the data_file() function (lines 526–528) both read the content_disposition query parameter directly from the request URL and embed it unsanitized into the Content-Disposition HTTP response header. Because rd.query is populated via urllib.parse.parse_qs, which URL-decodes all values, percent-encoded CRLF sequences (%0d%0a) are decoded into literal \r\n characters before header construction. The response writer in src/calibre/srv/http_response.py then writes each header as a raw string, allowing the injected \r\n to split the header line and introduce entirely new response headers. Exploitation requires valid credentials (low-privilege authenticated access) but no additional user interaction from the attacker's own session; a social engineering vector also exists by tricking an authenticated victim into clicking a crafted link (GitHub Advisory).

A successful exploit enables an authenticated attacker to inject arbitrary HTTP response headers, which can be leveraged for cross-site scripting (XSS) by injecting a Content-Type: text/html header with a malicious HTML body to execute JavaScript in a victim's browser context, session fixation via injected Set-Cookie headers, and cache poisoning if the calibre server sits behind a caching reverse proxy — potentially affecting all users of that proxy. Confidentiality and integrity are both partially impacted, while availability is unaffected (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, demonstrating header injection via a crafted GET request to /get/epub/1?content_disposition=attachment%0d%0aX-Injected:%20true%0d%0aSet-Cookie:%20evil=session. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.035% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nessus plugin 300512 has been released to detect this vulnerability (GitHub Advisory, Tenable).

1. Reconnaissance: Identify a running calibre Content Server instance with authentication enabled (calibre-server --enable-auth). Confirm at least one book exists in the library (e.g., book ID 1 with EPUB format) and obtain valid user credentials.
2. Craft the malicious request: Construct a GET request to the /get/ endpoint with a content_disposition parameter containing percent-encoded CRLF sequences to inject additional headers. Example:

GET /get/epub/1?content_disposition=attachment%0d%0aX-Injected:%20true%0d%0aSet-Cookie:%20evil=session HTTP/1.1
Host: <server>:8080
Authorization: Basic <base64-credentials>

3. Observe injected headers: The server response will contain the injected headers (X-Injected: true and Set-Cookie: evil=session) split from the Content-Disposition header value.
4. Escalate impact (optional): Inject Content-Type: text/html followed by a malicious HTML/JavaScript body to achieve XSS, or inject Set-Cookie headers to perform session fixation against a victim.
5. Social engineering vector: Craft a URL containing the malicious content_disposition parameter and send it to an authenticated victim. Since /get/ supports cookie-based auth via the android_workaround flag, the victim's browser will trigger the injection upon clicking the link (GitHub Advisory).

• Network: HTTP GET requests to /get/ or /data-files/get/ endpoints containing %0d, %0a, %0D, %0A, or literal CRLF sequences in the content_disposition query parameter; unexpected Set-Cookie or custom headers (e.g., X-Injected) appearing in calibre server responses.
• Logs: calibre Content Server access logs showing requests to /get/ or /data-files/get/ with content_disposition values other than attachment or inline; URL-encoded CRLF patterns (%0d%0a) in query strings within server logs.
• File System: No specific file artifacts expected for this vulnerability type, as exploitation is entirely network/HTTP-based.

Upgrade calibre to version 9.4.0 or later, which validates the content_disposition parameter against an allowlist of permitted values (attachment and inline), defaulting to attachment for any unrecognized value. As a temporary workaround prior to patching, restrict access to the calibre Content Server to trusted networks or authenticated users only, and place the server behind a reverse proxy that strips or validates the content_disposition query parameter. Debian has also issued updated packages addressing this vulnerability (GitHub Advisory, Debian).

The vulnerability was reported by researcher Mistz1 and disclosed via GitHub's security advisory program. Tenable released Nessus plugin 300512 to detect the issue, and ENISA catalogued it as EUVD-2026-9056. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation (GitHub Advisory, Tenable).