Improper Neutralization of CRLF Sequences
CWE-93
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
We track 109 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.
Latest Improper Neutralization of CRLF Sequences vulnerabilities
- 7.2 High severity
TR3000 1.0: Improper Neutralization of CRLF Sequences
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, w
- 7.2 High severity
TR3000 1.0: Improper Neutralization of CRLF Sequences
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftu
- 8.6 High severity
WebFOCUS: Improper Neutralization of CRLF Sequences
Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS. This issue affects WebFOCUS: 9.1, from 9.2 through 7, and from 9.3 through 7.
- 7.5 High severity
webmin: Improper Neutralization of CRLF Sequences
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash an
- 7.8 High severity
Kong Gateway Enterprise: Improper Neutralization of CRLF Sequences
Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream.
- 10.0 Critical severity
Adobe Connect: Improper Neutralization of CRLF Sequences
Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's accoun
- 7.5 High severity
mpv: Improper Neutralization of CRLF Sequences
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to
- 7.2 High severity
mail-mime-parser: Improper Neutralization of CRLF Sequences
zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values
- 8.1 High severity
core: Improper Neutralization of Special Elements in Output Used by a Downstream Component
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated priv
- 8.4 High severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be
- 9.1 Critical severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The
- 9.1 Critical severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched rem
- 9.1 Critical severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has bee
- 9.9 Critical severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely.
- 9.9 Critical severity
Pugongying X5 Pro: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotel
- 7.1 High severity
Webmail: Improper Neutralization of CRLF Sequences
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IM
- 7.1 High severity
Webmail: Improper Neutralization of CRLF Sequences
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbit
- 7.2 High severity
pfSense CE: Improper Neutralization of CRLF Sequences
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prep
- 7.2 High severity
pfSense CE: Improper Neutralization of CRLF Sequences
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interf
- 7.2 High severity
pfSense CE: Improper Neutralization of CRLF Sequences
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line
- 9.4 Critical severity
docker-mailbox: Improper Neutralization of CRLF Sequences
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated
- 9.9 Critical severity
froxlor: Improper Neutralization of CRLF Sequences
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the userinfo (user:pass@)
- 7.8 High severity
NetworkManager-vpnc: Improper Neutralization of CRLF Sequences
A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the ro
- 7.8 High severity
NetworkManager-vpnc: Improper Neutralization of CRLF Sequences
A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary
- 7.8 High severity
NetworkManager-fortisslvpn: Improper Neutralization of CRLF Sequences
A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit t
- 7.2 High severity
mail-mime-parser: Improper Neutralization of CRLF Sequences
zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF (carriage-return / line-feed) header injection (CWE-93) affe
- 8.8 High severity
luci-app-adblock-fast: Improper Neutralization of CRLF Sequences
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-fee
- 7.5 High severity
Red Hat build of Apache Camel for Spring Boot 4: Improper Neutralization of CRLF Sequences
A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF
- 8.0 High severity
DiskStation Manager (DSM): Improper Neutralization of CRLF Sequences
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduc
- 7.3 High severity
a2a-java: Improper Neutralization of CRLF Sequences
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the com
- 9.9 Critical severity
froxlor: Improper Neutralization of CRLF Sequences
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written
- 8.9 High severity
framework: Improper Neutralization of CRLF Sequences
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticate
- 9.6 Critical severity
IXON VPN Client: Improper Neutralization of CRLF Sequences
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, with
- 9.8 Critical severity
predis: Improper Neutralization of CRLF Sequences
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection:
- 9.8 Critical severity
nodemailer: Improper Neutralization of CRLF Sequences
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into t
- 9.8 Critical severity
Spring Framework: Improper Neutralization of CRLF Sequences
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 S
- 9.8 Critical severity
Spring Framework: Improper Neutralization of CRLF Sequences
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
- 8.6 High severity
logtape: Improper Neutralization of CRLF Sequences
LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue() function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structure
- 10.0 Critical severity
UniFi OS Server: Improper Neutralization of CRLF Sequences
A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.
- 9.0 Critical severity
UniFi OS Server: Improper Neutralization of CRLF Sequences
A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.