Fallos del tipo CWE-113

103 resultados

Injeção de quebras de linha em cabeçalhos HTTP

A aplicação recebe dados de entrada e os insere diretamente em cabeçalhos HTTP sem remover ou neutralizar caracteres CR (retorno de carro) e LF (quebra de linha). Um atacante pode injetar esses caracteres para quebrar o cabeçalho, adicionar cabeçalhos falsos ou até induzir resposta vazia, permitindo ataques como HTTP Response Splitting e Cache Poisoning.

Ejemplo

Um aplicativo web redireciona o usuário com `Location: /page?user=` + input do usuário. Se o usuário entra `attacker.com%0d%0aSet-Cookie:admin=true`, os caracteres %0d%0a (CR+LF) criam um novo cabeçalho, injetando um cookie malicioso na resposta HTTP.

Cómo mitigar

Valide e sanitize toda entrada antes de inserir em cabeçalhos: remova ou rejeite caracteres CR (\r) e LF (\n). Use funções seguras da linguagem (ex: em Java, frameworks como Spring já filtram por padrão) e implemente whitelist de caracteres permitidos para valores de cabeçalho.

CVE-2025-53007HIGHarduino-esp32 vulnerable to CRLF injection in WebServer.cppEPSS 0.4%CVE-2023-26137HIGHAll versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build headEPSS 0.4%CVE-2026-63771MEDIUMAdminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix HeaderEPSS 0.4%CVE-2025-0588MEDIUMIn affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By sEPSS 0.4%CVE-2025-0825MEDIUMCRLF injection in Cpp-httplibEPSS 0.4%CVE-2025-59151HIGHPi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injectionEPSS 0.4%CVE-2025-52479HIGHHTTP.jl vulnerable to CR/LF Injection in URIsEPSS 0.4%CVE-2026-42035HIGHAxios: Header Injection via Prototype PollutionEPSS 0.4%CVE-2025-53094HIGHESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cppEPSS 0.4%CVE-2026-67289CRITICALFreeRDP before 3.29.0 HTTP Proxy Request Injection via RedirectionEPSS 0.4%CVE-2024-20392MEDIUMA vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remEPSS 0.4%CVE-2022-37953MEDIUMWorkstationST - Response Splitting in AM Gateway Challenge-ResponseEPSS 0.4%CVE-2026-90819MEDIUMa2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splittingEPSS 0.4%CVE-2023-26147MEDIUMAll versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers valueEPSS 0.4%CVE-2026-43870HIGHApache Thrift: Node.js web_server.js multi-vulnerabilityEPSS 0.4%CVE-2026-24489MEDIUMGakido vulnerable to HTTP Header Injection (CRLF Injection)EPSS 0.4%CVE-2025-62826LOWAn Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FEPSS 0.4%CVE-2026-50630MEDIUMApache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm InjectionEPSS 0.4%CVE-2026-22779MEDIUMBlackSheep ClientSession is vulnerable to CRLF injectionEPSS 0.4%CVE-2025-61689HIGHHTTP.jl vulnerable to Header injection/Response splitting via header construction.EPSS 0.3%