Weaknesses of type CWE-113

114 results

Injeção de quebras de linha em cabeçalhos HTTP

A aplicação recebe dados de entrada (parâmetros, cookies, etc.) e os coloca diretamente em cabeçalhos HTTP sem remover ou escapar caracteres de quebra de linha (CR e LF). Um atacante injeta esses caracteres para adicionar cabeçalhos falsos, redirecionar o usuário ou contaminar cache HTTP, comprometendo a integridade da resposta.

Example

Um site reflete um parâmetro de URL direto no cabeçalho Location: um atacante envia `Location: /page Set-Cookie: admin=true`, e o servidor cria um cookie falso na resposta. Ou injeta ` CONTEÚDO_MALICIOSO` para poluir cache de proxy e servir conteúdo malicioso a outros usuários.

How to mitigate

Remova ou escape caracteres CR (0x0D) e LF (0x0A) de qualquer entrada antes de usá-la em cabeçalhos HTTP. Valide valores de entrada contra um whitelist de caracteres permitidos. Use bibliotecas de HTTP que façam isso automaticamente e nunca construa cabeçalhos concatenando strings.

CVE-2025-40927HIGHCGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flawEPSS 0.5%CVE-2023-34472MEDIUMAMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A succEPSS 0.5%CVE-2026-34520LOWAIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypassEPSS 0.5%CVE-2026-39915HIGHTIM Flow < 26.0.6 CRLF Injection via rt ParameterEPSS 0.5%CVE-2025-53007HIGHarduino-esp32 vulnerable to CRLF injection in WebServer.cppEPSS 0.5%CVE-2022-42472MEDIUMA improper neutralization of crlf sequences in http headers ('http response splitting') vulnerability in Fortinet FortiOS 7.2.0 through 7.2.EPSS 0.5%CVE-2026-77341MEDIUMcpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writingEPSS 0.5%CVE-2023-42450MEDIUMMastodon Server-Side Request Forgery vulnerabilityEPSS 0.5%CVE-2026-94216MEDIUMST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splittingEPSS 0.4%CVE-2026-73117CRITICALApache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataEPSS 0.4%CVE-2026-50188MEDIUMKirby: Request header injection in `Http\Remote`EPSS 0.4%CVE-2023-26147MEDIUMAll versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers valueEPSS 0.4%CVE-2025-59151HIGHPi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injectionEPSS 0.4%CVE-2023-26137HIGHAll versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build headEPSS 0.4%CVE-2025-52479HIGHHTTP.jl vulnerable to CR/LF Injection in URIsEPSS 0.4%CVE-2025-53094HIGHESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cppEPSS 0.4%CVE-2026-63771MEDIUMAdminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix HeaderEPSS 0.4%CVE-2026-67289CRITICALFreeRDP before 3.29.0 HTTP Proxy Request Injection via RedirectionEPSS 0.4%CVE-2025-0588MEDIUMIn affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By sEPSS 0.4%CVE-2025-0825MEDIUMCRLF injection in Cpp-httplibEPSS 0.4%