Fallos del tipo CWE-113

114 resultados

Injeção de quebras de linha em cabeçalhos HTTP

A aplicação recebe dados de entrada e os insere diretamente em cabeçalhos HTTP sem remover ou neutralizar caracteres CR (retorno de carro) e LF (quebra de linha). Um atacante pode injetar esses caracteres para quebrar o cabeçalho, adicionar cabeçalhos falsos ou até induzir resposta vazia, permitindo ataques como HTTP Response Splitting e Cache Poisoning.

Ejemplo

Um aplicativo web redireciona o usuário com `Location: /page?user=` + input do usuário. Se o usuário entra `attacker.com%0d%0aSet-Cookie:admin=true`, os caracteres %0d%0a (CR+LF) criam um novo cabeçalho, injetando um cookie malicioso na resposta HTTP.

Cómo mitigar

Valide e sanitize toda entrada antes de inserir em cabeçalhos: remova ou rejeite caracteres CR (\r) e LF (\n). Use funções seguras da linguagem (ex: em Java, frameworks como Spring já filtram por padrão) e implemente whitelist de caracteres permitidos para valores de cabeçalho.

CVE-2026-55766MEDIUMguzzlehttp/psr7: CRLF Injection in HTTP Start-Line SerializationEPSS 0.2%CVE-2026-120639—CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_pushEPSS 0.2%CVE-2026-7010MEDIUMHTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header valuesEPSS 0.2%CVE-2026-9658HIGHPlack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request pathsEPSS 0.2%CVE-2026-47675MEDIUMHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionEPSS 0.2%CVE-2026-34767MEDIUMElectron: HTTP Response Header Injection in custom protocol handlers and webRequestEPSS 0.2%CVE-2026-42874LOWMicrodot: HTTP response splitting in Response.set_cookie()EPSS 0.2%CVE-2026-54163MEDIUMsecure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted inputEPSS 0.2%CVE-2026-108767MEDIUMMultiple vulnerabilities that affects IBM Db2 Genius HubEPSS 0.2%CVE-2026-23686LOWCRLF Injection vulnerability in SAP NetWeaver Application Server JavaEPSS 0.2%CVE-2026-49214MEDIUMguzzlehttp/psr7 has CRLF Injection via URI Host ComponentEPSS 0.2%CVE-2026-112880LOWCRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackneyEPSS 0.2%CVE-2026-85976MEDIUMHTTP response splitting in Progress MarkLogic Server Query ConsoleEPSS 0.1%CVE-2026-21850MEDIUMHCL AION is affected by multiple security vulnerabilities.EPSS —