CVE-2024-25175

CVE-2024-25175 Reflected XSS via HTTP Response Splitting Description : Exploitation of this vulnerability can lead to the execution of JavaScript code in the victim's browser Cross-Site Scripting when following a specially crafted link. The vulnerability arises because The web server does not...

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values rouille Assigned CVE ID: CVE-2026-66746 Summary rouille writes response header values to the client without checking them for carriage return or line feed. An application that places attacker-influenced text into a...

CVE-2023-0214

SWG Exploit Generator ██████╗ ██████╗ ████████╗███████╗ ██╔═████╗██╔══██╗╚══██╔══╝██╔════╝ ██║██╔██║██████╔╝ ██║ ███████╗ ████╔╝██║██╔═══╝ ██║ ╚════██║ ╚██████╔╝██║ ██║ ███████║ ╚═════╝ ╚═╝ ╚═╝ ╚══════╝ by 0PTS Proof of Concept for the HTTP Response Splitting vulnerability in Skyhigh Secure Web...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

CVE-2024-40324

CVE-2024-40324 Description A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation. Vulnerability Type CRLF Vendor of Product E-Staff Affected Product Cod...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

CVE-2026-73117

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target fr...

CVE-2026-73117

The Apache Juneau REST server (through version 9.2.0 ) is vulnerable to HTTP Response Splitting due to the improper neutralization of CRLF sequences in HTTP headers. The framework fails to check response header values and redirect targets before passing them to the servlet container. If an applic...

CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target fr...

EUVD-2026-117412

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target fr...

PT-2026-137442

Name of the Vulnerable Software and Affected Versions Apache Juneau versions prior to 9.2.1 Description Improper Neutralization of CRLF Sequences in HTTP Headers, also known as HTTP Response Splitting, occurs when the REST server passes response header values and redirect targets to the servlet...

CVE-2026-108767

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...

EUVD-2026-117109

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...

CVE-2026-108767

IBM Db2 Genius Hub versions 1.1.2, 1.1.3, 1.1.4, and 1.1.5 are vulnerable to HTTP response splitting . This flaw is caused by the improper neutralization of HTTP headers , which could allow a remote authenticated attacker to exploit the system. The vulnerability is associated with CWE-113 . No sp...

CVE-2026-108767 Multiple vulnerabilities that affects IBM Db2 Genius Hub

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...

CVE-2026-85254

A flaw was found in Apache Camel's Platform HTTP component. The mechanism designed to prevent request headers from being reflected into HTTP responses improperly compares header names using case-sensitive checks. A remote attacker can exploit this behavior by varying header name casing or sending...

CVE-2026-120639

A flaw was found in perl-cgi, where it fails to properly validate newline characters when generating HTTP headers. When an application passes untrusted input into header fields, entity-encoded newlines or unvalidated parameters can bypass sanitization checks. A remote attacker could exploit this...

PT-2026-137133

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...

Ubuntu 16.04 LTS : Apt-Cacher vulnerability (USN-8976-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8976-1 advisory. It was discovered that Apt-Cacher did not properly handle encoded newline characters in requests. A remote attacker could possibly use this issue to perform HTTP...