Weakness (CWE)
CWE-93: Improper Neutralization of CRLF Sequences
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
How to prevent it (2 mitigations)
-
Implementation
Avoid using CRLF as a special sequence.
-
Implementation
Appropriately filter or quote CRLF sequences in user-controlled input.
Source: MITRE CWE-93
4 results · Clear filters · Feed
-
Medium 6.3CVE-2026-45067 Public exploit
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
### Description `Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply-to) flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a secur…
-
Medium 5.3CVE-2026-23829 Public exploit
Mailpit has SMTP Header Injection via Regex Bypass
Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject ar…
-
Medium —CVE-2018-12537 Public exploit
Moderate severity vulnerability that affects io.vertx:vertx-core
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or s…
-
Medium 6.4
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users t…