Improper Neutralization of CRLF Sequences in HTTP Headers
CWE-113
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
HTTP agents or components may include a web server, load balancer, reverse proxy, web caching proxy, application firewall, web browser, etc. Regardless of the role, they are expected to maintain coherent, consistent HTTP communication state across all components. However, including unexpected data in an HTTP header allows an attacker to specify the entirety of the HTTP message that is rendered by the client HTTP agent (e.g., web browser) or back-end HTTP agent (e.g., web server), whether the message is part of a request or a response. When an HTTP request contains unexpected CR and LF characters, the server may respond with an output stream that is interpreted as splitting the stream into two different HTTP messages instead of one. CR is carriage return, also given by %0d or r, and LF is line feed, also given by %0a or n. In addition to CR and LF characters, other valid/RFC compliant special characters and unique character encodings can be utilized, such as HT (horizontal tab, also given by %09 or t) and SP (space, also given as + sign or %20). These types of unvalidated and unexpected data in HTTP message headers allow an attacker to control the second split message to mount attacks such as server-side request forgery, cross-site scripting, and cache poisoning attacks.
We track 28 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
How this weakness is prevented
- Implementation: Construct HTTP headers very carefully, avoiding the use of non-validated input data.
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Latest Improper Neutralization of CRLF Sequences in HTTP Headers vulnerabilities
- 10.0 Critical severity
Apache Juneau: Improper Neutralization of CRLF Sequences in HTTP Headers
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets
- 9.3 Critical severity
goobi-viewer-core: Improper Neutralization of Input During Web Page Generation
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query paramet
- 9.2 Critical severity
ADM: Improper Neutralization of CRLF Sequences in HTTP Headers
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can lever
- 8.4 High severity
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a…
The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the u
- 8.2 High severity
sanic: Improper Neutralization of CRLF Sequences in HTTP Headers
Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed character
- 7.3 High severity
a2a-java: Improper Neutralization of CRLF Sequences
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the com
- 8.1 High severity
TIM Flow: Improper Neutralization of CRLF Sequences in HTTP Headers
TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected
- 7.5 High severity
FreeRDP: Improper Neutralization of CRLF Sequences in HTTP Headers
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HT
- 7.1 High severity
adminer: Improper Neutralization of CRLF Sequences in HTTP Headers
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit
- 7.5 High severity
aiohttp: Improper Neutralization of CRLF Sequences
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situatio
- 7.3 High severity
Plack::Middleware::Security::Common: Improper Neutralization of CRLF Sequences in HTTP Headers
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for example, GET
- 7.5 High severity
netty: Improper Neutralization of CRLF Sequences in HTTP Headers
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers
- 8.6 High severity
i18next-http-middleware: Improper Neutralization of Input During Web Page Generation
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after pass
- 7.3 High severity
Apache Thrift: Improper Limitation of a Pathname to a Restricted Directory
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Th
- 7.4 High severity
axios: Improper Neutralization of CRLF Sequences in HTTP Headers
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests.
- 7.2 High severity
Serendipity: Improper Neutralization of CRLF Sequences in HTTP Headers
Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without validation, and the existing sanitization f
- 8.8 High severity
Aftermarket DPC: Improper Neutralization of CRLF Sequences in HTTP Headers
HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker may be able to execute arbitrary commands or inject harmful content into the response..
- 8.2 High severity
web: Improper Neutralization of CRLF Sequences
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to
- 8.7 High severity
HTTP.jl: Improper Neutralization of CRLF Sequences in HTTP Headers
HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP
- 7.3 High severity
CGI::Simple: Improper Neutralization of CRLF Sequences in HTTP Headers
CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under c
- 8.7 High severity
ESPAsyncWebServer: Improper Neutralization of CRLF Sequences
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Carriage Return Line Feed) injection vulnerability exists in the construction and output of HTTP header
- 8.9 High severity
arduino-esp32: Improper Neutralization of CRLF Sequences in HTTP Headers
arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability. The `sendHeader` function takes arbitrary input for the HTTP header name and value, concatenates them into an HTTP head
- 7.7 High severity
HTTP.jl: Improper Neutralization of CRLF Sequences
HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers (URIs). URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF charact
- 8.8 High severity
Kerio Control: Improper Neutralization of CRLF Sequences in HTTP Headers
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location
- 8.1 High severity
trillium: Interpretation Conflict
Trillium is a composable toolkit for building internet applications with async rust. In `trillium-http` prior to 0.3.12 and `trillium-client` prior to 0.5.4, insufficient validation of outbound header values may lead to request splitting or response splitting
- 7.5 High severity
mastodon: Improper Neutralization of CRLF Sequences in HTTP Headers
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used
- 8.8 High severity
Splunk Enterprise: Interpretation Conflict
In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can trigger an HTTP response splitting vulnerability with the ‘rest’ SPL command that lets them potentially access other
- 7.5 High severity
SwiftNIO: Improper Neutralization of Special Elements in Output Used by a Downstream Component
NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some fo