Improper Neutralization of CRLF Sequences
CWE-93
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
We track 109 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.
Latest Improper Neutralization of CRLF Sequences vulnerabilities
- 8.2 High severity
cakephp: Improper Neutralization of CRLF Sequences
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowin
- 8.3 High severity
Joomla! CMS: Improper Neutralization of CRLF Sequences
Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.
- 7.3 High severity
kitty: Improper Neutralization of Special Elements used in a Command
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_
- 9.8 Critical severity
crontab-ui: Improper Neutralization of CRLF Sequences
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.
- 9.9 Critical severity
boringproxy: Improper Neutralization of CRLF Sequences
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded new
- 9.1 Critical severity
CHARX SEC-3150: Improper Neutralization of CRLF Sequences
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
- 7.2 High severity
Database Proxy: Improper Neutralization of CRLF Sequences
Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to e
- 7.6 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of CRLF Sequences
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inj
- 8.8 High severity
Archer VX1800v v1: Improper Neutralization of CRLF Sequences
A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data. An authenticated user
- 8.5 High severity
Jenkins Script Security Plugin: Improper Neutralization of CRLF Sequences
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script
- 7.5 High severity
http-proxy-middleware: Improper Neutralization of CRLF Sequences
http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart
- 7.5 High severity
aiohttp: Improper Neutralization of CRLF Sequences
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situatio
- 9.1 Critical severity
Net::Statsite::Client: Improper Neutralization of CRLF Sequences
Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd. Newlines are not removed from metric names, allowing metric injections. Values are not san
- 7.5 High severity
form-data: Improper Neutralization of CRLF Sequences
form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage r
- 9.1 Critical severity
Metrics::Any::Adapter::DogStatsd: Improper Neutralization of CRLF Sequences
Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::DogSta
- 8.2 High severity
Metrics::Any::Adapter::Statsd: Improper Neutralization of CRLF Sequences
Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet. The send method does not validate the contents of
- 9.1 Critical severity
DataDog::DogStatsd: Improper Neutralization of CRLF Sequences
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The send_stats method does not remove newlines from metric names ($stat v
- 9.8 Critical severity
DataDog::DogStatsd: Improper Neutralization of CRLF Sequences
DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does n
- 9.8 Critical severity
libinput: Improper Neutralization of CRLF Sequences
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
- 7.5 High severity
Etsy::StatsD: Improper Neutralization of CRLF Sequences
Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that the git repository co
- 9.9 Critical severity
cpp-httplib: Improper Neutralization of CRLF Sequences
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field
- 7.5 High severity
hackney: Improper Neutralization of CRLF Sequences
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL query component before constructing the HTTP/1.1 request targ
- 7.5 High severity
hackney: Improper Neutralization of CRLF Sequences
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade code in src/hackney_ws.erl copies the host, path, headers (ExtraHeaders), and protocols options from the
- 7.3 High severity
Net::Statsd::Lite: Improper Neutralization of CRLF Sequences
Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that version
- 8.2 High severity
Net::Statsd::Tiny: Improper Neutralization of CRLF Sequences
Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.
- 8.3 High severity
cPanel: Improper Neutralization of CRLF Sequences
Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.
- 7.1 High severity
netty: Improper Neutralization of CRLF Sequences
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or saniti
- 7.5 High severity
netty: Improper Neutralization of CRLF Sequences in HTTP Headers
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers
- 9.8 Critical severity
net-imap: Improper Neutralization of Special Elements used in a Command
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this s
- 7.8 High severity
phpunit: Improper Neutralization of Argument Delimiters in a Command
PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's
- 8.8 High severity
FTL: Improper Neutralization of CRLF Sequences
Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. In versions before 6.6.1, the `dns.interface` configuration field in Pi-hole FTL accepted newline characters without validation, allowing an attacker to inject arbit
- 8.8 High severity
Sandboxie: Improper Neutralization of CRLF Sequences
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbi
- 8.8 High severity
Pardus Update: Improper Neutralization of CRLF Sequences
Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Authentication Bypass. This issue affects Pardus Update: from 0.6.3 before 0.6.4.
- 8.5 High severity
froxlor: Improper Neutralization of CRLF Sequences
Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the `content` field. When a DNS type not covered by the if/el
- 7.5 High severity
MailGates: Improper Neutralization of CRLF Sequences
MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read system files.
- 8.6 High severity
basic-ftp: Improper Neutralization of CRLF Sequences
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(
- 9.8 Critical severity
ci4ms: Improper Neutralization of CRLF Sequences
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST parameter without any validation and passes it
- 8.8 High severity
FTL: Improper Neutralization of Special Elements used in an OS Command
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP hosts configuration parameter (dhcp.hosts
- 8.8 High severity
FTL: Improper Neutralization of Special Elements used in an OS Command
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DHCP lease time configuration parameter (dhcp.
- 8.8 High severity
FTL: Improper Neutralization of Special Elements used in an OS Command
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.h