FortiOS FortiProxy CRLF Injection Code Execution

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-21428

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the writeheaders function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines. This vulnerability allows attackers to add...

Supplier Invoice Component SAP S/4HANA Bypass Security Restrictions

The vulnerability of the Supplier Invoice component in the SAP S/4HANA software platform is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions from a remote location...

CLSA-2025-1756323917 php: Fix of CVE-2025-1736

CVE-2025-1736: fix incorrect validation of CRLF in http headers...

Spring Framework HTTP Response Splitting

The vulnerability of the Spring Framework is related to the failure to handle CRLF sequences in HTTP headers or “HTTP response splitting”. Exploiting this vulnerability allows an attacker to perform a RFD attack by utilizing the “Content-Disposition” header...