Fallos del tipo CWE-113

110 resultados

Injeção de quebras de linha em cabeçalhos HTTP

A aplicação recebe dados de entrada e os insere diretamente em cabeçalhos HTTP sem remover ou neutralizar caracteres CR (retorno de carro) e LF (quebra de linha). Um atacante pode injetar esses caracteres para quebrar o cabeçalho, adicionar cabeçalhos falsos ou até induzir resposta vazia, permitindo ataques como HTTP Response Splitting e Cache Poisoning.

Ejemplo

Um aplicativo web redireciona o usuário com `Location: /page?user=` + input do usuário. Se o usuário entra `attacker.com%0d%0aSet-Cookie:admin=true`, os caracteres %0d%0a (CR+LF) criam um novo cabeçalho, injetando um cookie malicioso na resposta HTTP.

Cómo mitigar

Valide e sanitize toda entrada antes de inserir em cabeçalhos: remova ou rejeite caracteres CR (\r) e LF (\n). Use funções seguras da linguagem (ex: em Java, frameworks como Spring já filtram por padrão) e implemente whitelist de caracteres permitidos para valores de cabeçalho.

CVE-2026-24489MEDIUMGakido vulnerable to HTTP Header Injection (CRLF Injection)EPSS 0.4%CVE-2022-37953MEDIUMWorkstationST - Response Splitting in AM Gateway Challenge-ResponseEPSS 0.4%CVE-2024-20392MEDIUMA vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remEPSS 0.4%CVE-2026-43870HIGHApache Thrift: Node.js web_server.js multi-vulnerabilityEPSS 0.4%CVE-2026-50630MEDIUMApache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm InjectionEPSS 0.4%CVE-2025-62826LOWAn Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FEPSS 0.4%CVE-2026-93711MEDIUMDancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_arrayEPSS 0.4%CVE-2026-22779MEDIUMBlackSheep ClientSession is vulnerable to CRLF injectionEPSS 0.4%CVE-2026-103930LOWcpp-httplib open_stream serializes CRLF in request target into HTTP request lineEPSS 0.4%CVE-2025-61689HIGHHTTP.jl vulnerable to Header injection/Response splitting via header construction.EPSS 0.3%CVE-2026-66746MEDIUMRouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header InjectionEPSS 0.3%CVE-2026-34715MEDIUMewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)EPSS 0.3%CVE-2026-38967CRITICALCrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values.EPSS 0.3%CVE-2025-55271LOWHCL Aftermarket DPC is affected by HTTP Response Splitting vulnerabilityEPSS 0.3%CVE-2026-41683HIGHHTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language headerEPSS 0.3%CVE-2026-34514LOWAIOHTTP: CRLF injection in multipart part content type header constructionEPSS 0.3%CVE-2026-69211MEDIUMHttp4s: Set-Cookie rendering does not escape attribute delimitersEPSS 0.3%CVE-2026-106512HIGHMISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSSEPSS 0.3%CVE-2026-38978MEDIUMtransmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.EPSS 0.3%CVE-2026-34519LOWAIOHTTP: HTTP response splitting via \r in reason phraseEPSS 0.3%