CVE-2023-0214

SWG Exploit Generator ██████╗ ██████╗ ████████╗███████╗ ██╔═████╗██╔══██╗╚══██╔══╝██╔════╝ ██║██╔██║██████╔╝ ██║ ███████╗ ████╔╝██║██╔═══╝ ██║ ╚════██║ ╚██████╔╝██║ ██║ ███████║ ╚═════╝ ╚═╝ ╚═╝ ╚══════╝ by 0PTS Proof of Concept for the HTTP Response Splitting vulnerability in Skyhigh Secure Web...

CVE-2026-73117

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target fr...

CVE-2026-73117

The Apache Juneau REST server (through version 9.2.0 ) is vulnerable to HTTP Response Splitting due to the improper neutralization of CRLF sequences in HTTP headers. The framework fails to check response header values and redirect targets before passing them to the servlet container. If an applic...

EUVD-2026-117412

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target fr...

CVE-2026-108767

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...

CVE-2026-108767

IBM Db2 Genius Hub versions 1.1.2, 1.1.3, 1.1.4, and 1.1.5 are vulnerable to HTTP response splitting . This flaw is caused by the improper neutralization of HTTP headers , which could allow a remote authenticated attacker to exploit the system. The vulnerability is associated with CWE-113 . No sp...

EUVD-2026-117109

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...

CVE-2026-85254

A flaw was found in Apache Camel's Platform HTTP component. The mechanism designed to prevent request headers from being reflected into HTTP responses improperly compares header names using case-sensitive checks. A remote attacker can exploit this behavior by varying header name casing or sending...

CVE-2026-120639

A flaw was found in perl-cgi, where it fails to properly validate newline characters when generating HTTP headers. When an application passes untrusted input into header fields, entity-encoded newlines or unvalidated parameters can bypass sanitization checks. A remote attacker could exploit this...

PT-2026-137133

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...

CVE-2026-121439

A flaw was found in wasmtime. The wasi-http component fails to properly validate Content-Length headers when processing network responses. A malicious WebAssembly guest can supply an invalid Content-Length header and splice response bodies, allowing HTTP Hypertext Transfer Protocol response...

CVE-2024-40324

CVE-2024-40324 Description A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation. Vulnerability Type CRLF Vendor of Product E-Staff Affected Product Cod...

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values rouille Assigned CVE ID: CVE-2026-66746 Summary rouille writes response header values to the client without checking them for carriage return or line feed. An application that places attacker-influenced text into a...

CVE-2024-25175

CVE-2024-25175 Reflected XSS via HTTP Response Splitting Description : Exploitation of this vulnerability can lead to the execution of JavaScript code in the victim's browser Cross-Site Scripting when following a specially crafted link. The vulnerability arises because The web server does not...

Vulnerabilities fixed in Juniper Networks Session Smart Router and Session Smart Conductor

Juniper has addressed multiple vulnerabilities in Juniper Networks Session Smart Router and Session Smart Conductor. These vulnerabilities affect various components within both products. - There are out-of-bounds read and write errors in the HTTP parser, TCP proxy, TCP header processing, and VRRP...

CLEANSTART-2026-PC80984 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

CVE-2026-103405

A vulnerability exists in the web server of Juniper Networks Session Smart Router and Session Smart Conductor . The root cause is an Improper Neutralization of Special Elements in Output Used by a Downstream Component (CWE-74) , where the system fails to sanitize request body parameters. This all...

CVE-2026-103405 Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting

An Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters...

HTTP Response Splitting

io.netty:netty-codec-http is vulnerable to HTTP response splitting. The vulnerability is due to incorrect pairing of outbound responses with inbound requests when processing 100 Continue informational responses, which allows an attacker to exploit pipelined HTTP/1.1 GET and HEAD requests with...