Falhas do tipo CWE-113

103 resultados

Injeção de quebra de linha em cabeçalhos HTTP

A aplicação recebe dados de entrada e os insere diretamente em cabeçalhos HTTP sem remover ou neutralizar caracteres de quebra de linha (CR e LF). Um atacante pode injetar cabeçalhos maliciosos ou manipular o corpo da resposta, levando a ataques como HTTP Response Splitting, divisão de cache e roubo de sessão.

Exemplo

Um formulário de feedback que recebe o nome do usuário e o coloca no cabeçalho 'X-User-Feedback' sem validação. Se o atacante submeter 'João%0d%0aSet-Cookie: admin=true', consegue injetar um novo cabeçalho Set-Cookie na resposta HTTP.

Como mitigar

Valide e sanitize toda entrada que será usada em cabeçalhos HTTP: remova ou rejeite caracteres CR (\r, %0D) e LF (\n, %0A). Use listas brancas de caracteres permitidos e prefira APIs que já façam essa validação automaticamente.

CVE-2026-39971HIGHSerendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOSTEPSS 0.3%CVE-2026-43966MEDIUMHTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2EPSS 0.3%CVE-2026-24320LOWMemory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)EPSS 0.2%CVE-2024-58384MEDIUMTornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClientEPSS 0.2%CVE-2026-66746MEDIUMRouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header InjectionEPSS 0.2%CVE-2026-48596LOWCRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injectionEPSS 0.2%CVE-2026-44489LOWAxios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype FixEPSS 0.2%CVE-2024-45687LOWHTTP Server incorrectly accepting disallowed characters within header valuesEPSS 0.2%CVE-2026-55766MEDIUMguzzlehttp/psr7: CRLF Injection in HTTP Start-Line SerializationEPSS 0.2%CVE-2026-7010MEDIUMHTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header valuesEPSS 0.2%CVE-2026-9658HIGHPlack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request pathsEPSS 0.2%CVE-2026-91991MEDIUMTornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargsEPSS 0.2%CVE-2026-66753MEDIUMtiny-http 0.12.0 HTTP Response Splitting via Header InjectionEPSS 0.2%CVE-2026-69211MEDIUMHttp4s: Set-Cookie rendering does not escape attribute delimitersEPSS 0.2%CVE-2026-47675MEDIUMHono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionEPSS 0.2%CVE-2026-42874LOWMicrodot: HTTP response splitting in Response.set_cookie()EPSS 0.2%CVE-2026-34767MEDIUMElectron: HTTP Response Header Injection in custom protocol handlers and webRequestEPSS 0.2%CVE-2026-27810MEDIUMcalibre Vulnerable to HTTP Response Header InjectionEPSS 0.2%CVE-2026-59314LOWSpring Framework response splitting in ContentDispositionEPSS 0.2%CVE-2026-49214MEDIUMguzzlehttp/psr7 has CRLF Injection via URI Host ComponentEPSS 0.2%