Weaknesses of type CWE-113

103 results

Injeção de quebras de linha em cabeçalhos HTTP

A aplicação recebe dados de entrada (parâmetros, cookies, etc.) e os coloca diretamente em cabeçalhos HTTP sem remover ou escapar caracteres de quebra de linha (CR e LF). Um atacante injeta esses caracteres para adicionar cabeçalhos falsos, redirecionar o usuário ou contaminar cache HTTP, comprometendo a integridade da resposta.

Example

Um site reflete um parâmetro de URL direto no cabeçalho Location: um atacante envia `Location: /page Set-Cookie: admin=true`, e o servidor cria um cookie falso na resposta. Ou injeta ` CONTEÚDO_MALICIOSO` para poluir cache de proxy e servir conteúdo malicioso a outros usuários.

How to mitigate

Remova ou escape caracteres CR (0x0D) e LF (0x0A) de qualquer entrada antes de usá-la em cabeçalhos HTTP. Valide valores de entrada contra um whitelist de caracteres permitidos. Use bibliotecas de HTTP que façam isso automaticamente e nunca construa cabeçalhos concatenando strings.

CVE-2026-39971HIGHSerendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOSTEPSS 0.3%CVE-2026-43966MEDIUMHTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2EPSS 0.3%CVE-2026-24320LOWMemory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)EPSS 0.2%CVE-2024-58384MEDIUMTornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClientEPSS 0.2%CVE-2026-66746MEDIUMRouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header InjectionEPSS 0.2%CVE-2026-48596LOWCRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injectionEPSS 0.2%CVE-2026-44489LOWAxios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype FixEPSS 0.2%CVE-2024-45687LOWHTTP Server incorrectly accepting disallowed characters within header valuesEPSS 0.2%CVE-2026-55766MEDIUMguzzlehttp/psr7: CRLF Injection in HTTP Start-Line SerializationEPSS 0.2%CVE-2026-7010MEDIUMHTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header valuesEPSS 0.2%CVE-2026-9658HIGHPlack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request pathsEPSS 0.2%CVE-2026-91991MEDIUMTornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargsEPSS 0.2%CVE-2026-66753MEDIUMtiny-http 0.12.0 HTTP Response Splitting via Header InjectionEPSS 0.2%CVE-2026-69211MEDIUMHttp4s: Set-Cookie rendering does not escape attribute delimitersEPSS 0.2%CVE-2026-47675MEDIUMHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionEPSS 0.2%CVE-2026-42874LOWMicrodot: HTTP response splitting in Response.set_cookie()EPSS 0.2%CVE-2026-34767MEDIUMElectron: HTTP Response Header Injection in custom protocol handlers and webRequestEPSS 0.2%CVE-2026-27810MEDIUMcalibre Vulnerable to HTTP Response Header InjectionEPSS 0.2%CVE-2026-59314LOWSpring Framework response splitting in ContentDispositionEPSS 0.2%CVE-2026-49214MEDIUMguzzlehttp/psr7 has CRLF Injection via URI Host ComponentEPSS 0.2%