Weakness (CWE)
CWE-93: Improper Neutralization of CRLF Sequences
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
How to prevent it (2 mitigations)
-
Implementation
Avoid using CRLF as a special sequence.
-
Implementation
Appropriately filter or quote CRLF sequences in user-controlled input.
Source: MITRE CWE-93
283 results · Feed
-
Medium 6.3
Kiteworks Core Command Execution through Configuration Injection
In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, poten…
-
Medium 6.6
Kiteworks Core Server-Side Request Forgery through CRLF Injection
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution.
-
Medium 5.8
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the…
-
Critical 9.4
Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticate…
-
Critical 9.9
froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the userinfo (user:pass@…
-
High 7.8
Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection
A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the r…
-
High 7.8
Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username
A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrar…
-
High 7.8
Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials
A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit …
-
High 7.2
zbateson/mail-mime-parser has CRLF header injection via attachment filename
zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF (carriage-return / line-feed) header injection (CWE-93) aff…
-
Medium 5.3
Livestatus injection via monitoring filter values
Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to inf…
-
High 8.8
luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-fe…
-
Medium 4.3
ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting
A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splittin…
-
Medium 4.0
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead de…
-
High 7.5
Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)
A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/L…
-
High 8.0
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manag…
-
Low 3.5
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Ma…
-
Medium 5.4
Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or constru…
-
High 7.3
a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the co…
-
Critical 9.9
froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written…
-
Medium 6.5
Froxlor before 2.3.12 SSH Key Injection via authorized_keys
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files. Attackers can inject malicious SSH key entries with option directives to gain …
-
Medium 4.8
MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the em…
-
Medium 4.8
JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e…
-
High 8.9CVE-2026-48019 Public exploit
CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…
-
Critical 9.6
IXON VPN Client CRLF Injection
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, wit…
-
Medium 4.2
Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side…
-
Medium 5.3
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, conten…
-
Critical 9.8
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection…
-
Critical 9.8
Nodemailer before 8.0.4 SMTP Command Injection via envelope.size
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into …
-
Medium 4.9
Nodemailer before 8.0.5 SMTP Command Injection via CRLF
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed character…
-
Medium 5.4
Nodemailer CRLF Injection via List-* Header Comments
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create addi…
-
Medium 4.8
Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator…
-
Medium 5.3
cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additi…
-
Critical 9.8
Server Sent Event stream corruption in Spring MVC functional web framework
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 …
-
Critical 9.8
Spring Framework Server Sent Event stream corruption while rendering fragments
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
-
High 8.6
@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue() function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structur…
-
Critical 10.0
A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability f…
-
Critical 9.0
A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of C…
-
High 8.2
CakePHP: SmtpTransport vulnerable to CRLF header injection
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowi…
-
Medium 5.3
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. PSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the client URL has become a …
-
Medium 5.8
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a lin…