Falhas do tipo CWE-113

114 resultados

Injeção de quebra de linha em cabeçalhos HTTP

A aplicação recebe dados de entrada e os insere diretamente em cabeçalhos HTTP sem remover ou neutralizar caracteres de quebra de linha (CR e LF). Um atacante pode injetar cabeçalhos maliciosos ou manipular o corpo da resposta, levando a ataques como HTTP Response Splitting, divisão de cache e roubo de sessão.

Exemplo

Um formulário de feedback que recebe o nome do usuário e o coloca no cabeçalho 'X-User-Feedback' sem validação. Se o atacante submeter 'João%0d%0aSet-Cookie: admin=true', consegue injetar um novo cabeçalho Set-Cookie na resposta HTTP.

Como mitigar

Valide e sanitize toda entrada que será usada em cabeçalhos HTTP: remova ou rejeite caracteres CR (\r, %0D) e LF (\n, %0A). Use listas brancas de caracteres permitidos e prefira APIs que já façam essa validação automaticamente.

CVE-2026-34519LOWAIOHTTP: HTTP response splitting via \r in reason phraseEPSS 0.3%CVE-2023-48256MEDIUMThe vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s seEPSS 0.3%CVE-2026-66753MEDIUMtiny-http 0.12.0 HTTP Response Splitting via Header InjectionEPSS 0.3%CVE-2025-71381MEDIUMHono - Vary Header Injection in CORS MiddlewareEPSS 0.3%CVE-2025-30221MEDIUMPitchfork HTTP Request/Response Splitting vulnerabilityEPSS 0.3%CVE-2025-42934MEDIUMCRLF Injection vulnerability in SAP S/4HANA (Supplier invoice)EPSS 0.3%CVE-2026-44214MEDIUMeventsource-encoder: SSE event injection via unsanitized event and id fieldsEPSS 0.3%CVE-2026-2811MEDIUMAjaxify Comments < 3.2 - Unauthenticated HTTP Header InjectionEPSS 0.3%CVE-2025-62675LOWAn Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FEPSS 0.3%CVE-2026-24320LOWMemory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)EPSS 0.3%CVE-2026-43966MEDIUMHTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2EPSS 0.3%CVE-2026-55486CRITICALGoobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSSEPSS 0.3%CVE-2026-59314LOWSpring Framework response splitting in ContentDispositionEPSS 0.3%CVE-2026-39971HIGHSerendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOSTEPSS 0.3%CVE-2024-58384MEDIUMTornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClientEPSS 0.2%CVE-2026-91991MEDIUMTornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargsEPSS 0.2%CVE-2026-27810MEDIUMcalibre Vulnerable to HTTP Response Header InjectionEPSS 0.2%CVE-2026-48596LOWCRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injectionEPSS 0.2%CVE-2026-44489LOWAxios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype FixEPSS 0.2%CVE-2024-45687LOWHTTP Server incorrectly accepting disallowed characters within header valuesEPSS 0.2%