Improper Neutralization of CRLF Sequences
CWE-93
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
We track 109 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 1 has been exploited in real attacks.
How this weakness is prevented
- Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.
Latest Improper Neutralization of CRLF Sequences vulnerabilities
- 8.8 High severity
FTL: Improper Neutralization of Special Elements used in an OS Command
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS CNAME records configuration parameter (dns
- 8.8 High severity
FTL: Improper Neutralization of Special Elements used in an OS Command
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (
- 10.0 Critical severity
h3: Improper Neutralization of CRLF Sequences
H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamCo
- 8.2 High severity
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32.
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in head
- 8.6 High severity
ShopLentor – All-in-One WooCommerce Growth &…: Improper Neutralization of CRLF Sequences
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'produ
- 8.7 High severity
incus: Improper Neutralization of CRLF Sequences
Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, wh
- 7.5 High severity
ComfyUI-Manager: Improper Neutralization of CRLF Sequences
ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead t
- 7.5 High severity
cpp-httplib: Improper Neutralization of CRLF Sequences
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines. Th
- 8.2 High severity
web: Improper Neutralization of CRLF Sequences
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to
- 7.5 High severity
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Exploited
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compr
- 8.8 High severity
PostgreSQL: Improper Neutralization of CRLF Sequences
Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose
- 7.2 High severity
Geodi: Improper Neutralization of CRLF Sequences
Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in DECE Software Geodi allows HTTP Request Splitting. This issue affects Geodi: before GEODI Setup 9.0.146.
- 8.7 High severity
ESPAsyncWebServer: Improper Neutralization of CRLF Sequences
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Carriage Return Line Feed) injection vulnerability exists in the construction and output of HTTP header
- 7.7 High severity
HTTP.jl: Improper Neutralization of CRLF Sequences
HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers (URIs). URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF charact
- 9.3 Critical severity
Gestnet: Improper Neutralization of CRLF Sequences
SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘fk_remoto_central’ parameter on the ‘/webservices/articles.php’ endpoint.
- 7.1 High severity
QTS: Improper Neutralization of CRLF Sequences
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to modify application dat
- 7.5 High severity
rack: Improper Neutralization of CRLF Sequences
Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log
- 7.5 High severity
QTS: Improper Neutralization of CRLF Sequences
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the
- 7.5 High severity
QTS: Improper Neutralization of CRLF Sequences
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the
- 10.0 Critical severity
refit: Improper Neutralization of CRLF Sequences
Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes (Header, HeaderCollection and Authorize) are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the `HttpHead
- 7.8 High severity
RestSharp: Improper Neutralization of Special Elements in Output Used by a Downstream Component
RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to `RestRequest.AddHeader` (the header value) is vulnerable to CRLF injection. The same applies to `RestRequest.AddOrUpdateHeader` and `RestClient.AddDefaultHeader`. The way HTTP head
- 8.4 High severity
Symantec SiteMinder: Improper Neutralization of CRLF Sequences
A CRLF cross-site scripting vulnerability has been identified in certain configurations of the SiteMinder Web Agent for IIS Web Server and SiteMinder Web Agent for Domino Web Server. As a result, an attacker can execute arbitrary Javascript code in a client br
- 8.2 High severity
Connect Secure: Improper Neutralization of CRLF Sequences
A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack.
- 9.6 Critical severity
PWAsForFirefox: Improper Neutralization of Special Elements in Output Used by a Downstream Component
PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as name, description, shortcuts), web apps were able to inject additional lines into XDG Desktop Entrie
- 7.5 High severity
Http File Server: Improper Neutralization of CRLF Sequences
The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the bro
- 8.2 High severity
Cisco Secure Client: Improper Neutralization of CRLF Sequences
A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user. This vulnerability is due to insufficient validation of use
- 8.8 High severity
yhirose/cpp-httplib: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehav
- 7.5 High severity
Async HTTP Client: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users ar
- 7.5 High severity
microweber/microweber: Improper Neutralization of CRLF Sequences
CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.