Skip to content
OpenAdvisories

Weakness (CWE)

CWE-93: Improper Neutralization of CRLF Sequences

Base Draft

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

How to prevent it (2 mitigations)

  1. Implementation

    Avoid using CRLF as a special sequence.

  2. Implementation

    Appropriately filter or quote CRLF sequences in user-controlled input.

Source: MITRE CWE-93

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-40324 Public exploit

    A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) chara…

  • Critical 9.8
    CVE-2015-5285 Public exploit

    Kallithea CRLF injection vulnerability

    CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.

    kallithea PyPI