CVE-2026-12127: Improper Neutralization of CRLF Sequences

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences 'CRLF Injection' in all versions up to, and including, 1.10.2 This is due to getreplytoaddress processing the Reply-To...

PT-2026-54465

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences 'CRLF Injection' in all versions up to, and including, 1.10.2 This is due to get reply to address processing the Reply-To...

PT-2026-76583

Name of the Vulnerable Software and Affected Versions Libevent versions prior to 2.1.13 Libevent versions prior to 2.2.2-alpha Description Two HTTP parsing weaknesses exist in the http.c file. The function evhttp decode uri internal decodes percent-encoded %00 bytes into literal NUL characters,...

CVE-2025-71381: Improper Neutralization of CRLF Sequences in HTTP Headers

Hono before 4.10.2 fixed in 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary...

CVE-2026-50269

A flaw was found in aiohttp, an asynchronous HTTP client/server framework. This vulnerability, known as CRLF Carriage Return Line Feed injection, allows an attacker to modify HTTP requests by injecting malicious input into multipart or payload headers. If an application processes user-controlled...

Linux Distros Unpatched Vulnerability : CVE-2026-47240

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw data...

Linux Distros Unpatched Vulnerability : CVE-2026-47241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw stri...

Configuration Injection via Carriage Return (\r) in write() method

...

EUVD-2026-31690

Hackney has CRLF / header injection in WebSocket upgrade request...

GHSA-MP55-P8C9-RFW2 Hackney has CRLF / header injection via unvalidated `domain` and `path` options

Summary CRLF injection in hackneycookie:setcookie/3 src/hackneycookie.erl. The function validates Name and Value against CR/LF and control characters but concatenates the domain and path options verbatim into the output binary. If either option carries attacker-controlled data, a Host header...

EUVD-2026-31683

Hackney has CRLF / header injection via unvalidated domain and path options...

Hackney has CRLF / header injection via unvalidated `domain` and `path` options

Summary CRLF injection in hackneycookie:setcookie/3 src/hackneycookie.erl. The function validates Name and Value against CR/LF and control characters but concatenates the domain and path options verbatim into the output binary. If either option carries attacker-controlled data, a Host header...

CVE-2026-28898

The swift-nio-http2 library is vulnerable to HTTP/2-to-HTTP/1.1 request smuggling because the HTTP2FramePayloadToHTTP1ServerCodec and HTTP2ToHTTP1ServerCodec components fail to validate pseudo-header values for control characters. A remote attacker can inject CR () , LF () , or NUL () bytes into ...

CVE-2026-28898

swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values :path, :authority, :scheme, :method, and :status at both the HPACK...

CVE-2026-28898: Improper Encoding or Escaping of Output

swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values :path, :authority, :scheme, :method, and :status at both the HPACK...

Astra Linux – Vulnerability in libsoup3

A flaw was discovered in libsoup. An attacker who controls the value used to set the Content-Type header can inject a Carriage Return Line Feed CRLF sequence due to improper input sanitization in the soupmessageheaderssetcontenttype function. This vulnerability allows for the injection of arbitra...

ROS-20260624-73-0044

The vulnerability in python-aiohttp is related to the failure to handle CR LF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

CVE-2026-57281: Improper Neutralization of CRLF Sequences

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the...

CVE-2026-55766

A flaw was found in guzzlehttp/psr7, a PHP library for HTTP messages. This vulnerability allows a remote attacker to inject arbitrary header lines into serialized HTTP/1.x messages. The flaw stems from the library's failure to reject carriage return CR and line feed LF characters in HTTP start-li...

CVE-2026-55766

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled dat...