Fallos del tipo CWE-113

112 resultados

Injeção de quebras de linha em cabeçalhos HTTP

A aplicação recebe dados de entrada e os insere diretamente em cabeçalhos HTTP sem remover ou neutralizar caracteres CR (retorno de carro) e LF (quebra de linha). Um atacante pode injetar esses caracteres para quebrar o cabeçalho, adicionar cabeçalhos falsos ou até induzir resposta vazia, permitindo ataques como HTTP Response Splitting e Cache Poisoning.

Ejemplo

Um aplicativo web redireciona o usuário com `Location: /page?user=` + input do usuário. Se o usuário entra `attacker.com%0d%0aSet-Cookie:admin=true`, os caracteres %0d%0a (CR+LF) criam um novo cabeçalho, injetando um cookie malicioso na resposta HTTP.

Cómo mitigar

Valide e sanitize toda entrada antes de inserir em cabeçalhos: remova ou rejeite caracteres CR (\r) e LF (\n). Use funções seguras da linguagem (ex: em Java, frameworks como Spring já filtram por padrão) e implemente whitelist de caracteres permitidos para valores de cabeçalho.

CVE-2026-85077HIGHSanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responsesEPSS 0.5%CVE-2023-34472MEDIUMAMI SPx contains a vulnerability in the BMC where an Attacker may cause an improper neutralization of CRLF sequences in HTTP Headers. A succEPSS 0.5%CVE-2026-34520LOWAIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypassEPSS 0.5%CVE-2026-39915HIGHTIM Flow < 26.0.6 CRLF Injection via rt ParameterEPSS 0.5%CVE-2025-53007HIGHarduino-esp32 vulnerable to CRLF injection in WebServer.cppEPSS 0.5%CVE-2022-42472MEDIUMA improper neutralization of crlf sequences in http headers ('http response splitting') vulnerability in Fortinet FortiOS 7.2.0 through 7.2.EPSS 0.5%CVE-2026-77341MEDIUMcpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writingEPSS 0.5%CVE-2023-42450MEDIUMMastodon Server-Side Request Forgery vulnerabilityEPSS 0.5%CVE-2026-94216MEDIUMST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splittingEPSS 0.4%CVE-2026-50188MEDIUMKirby: Request header injection in `Http\Remote`EPSS 0.4%CVE-2023-26147MEDIUMAll versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers valueEPSS 0.4%CVE-2025-59151HIGHPi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injectionEPSS 0.4%CVE-2023-26137HIGHAll versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build headEPSS 0.4%CVE-2025-52479HIGHHTTP.jl vulnerable to CR/LF Injection in URIsEPSS 0.4%CVE-2026-63771MEDIUMAdminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix HeaderEPSS 0.4%CVE-2025-53094HIGHESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cppEPSS 0.4%CVE-2026-67289CRITICALFreeRDP before 3.29.0 HTTP Proxy Request Injection via RedirectionEPSS 0.4%CVE-2025-0588MEDIUMIn affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By sEPSS 0.4%CVE-2025-0825MEDIUMCRLF injection in Cpp-httplibEPSS 0.4%CVE-2026-42035HIGHAxios: Header Injection via Prototype PollutionEPSS 0.4%