The vulnerability of the process_headers function (gunicorn/http/wsgi.py) in the WSGI server gunicorn, which allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the processheaders function gunicorn/http/wsgi.py in the WSGI server gunicorn exists due to the lack of measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to perform XSS attacks...

HTTP Host Header Injection

A host header injection is inserting both the carriage return and linefeed characters into user input to trick the server. Successful exploitation could allow attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks...

CVE-2019-11823

CRLF injection vulnerability in Network Center in Synology Router Manager SRM before 1.2.3-8017-2 allows remote attackers to cause a denial of service out-of-bounds read and application crash via crafted network traffic...

USN-4333-1 python2.7, python3.4, python3.5, python3.6, python3.7 vulnerabilities

It was discovered that Python incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. CVE-2019-18348 It was discovered that Python incorrectly handled certain HTTP requests. An attacker could possibly use this issue to cause a denia...

python: CRLF injection via the query part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the query string after a ? charact...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

python: CRLF injection via the path part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n specifically in the path component of a URL that...

GHSA-MVQP-Q37C-WF9J io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection')

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' Versions of Ratpack 0.9.1 through and including 1.7.4 are vulnerable to HTTP Response Splitting, if untrusted and unsanitized data is used to populate the headers of an HTTP response. An attacker can...

Twisted Input Validation Error Vulnerability

Twisted is an event-driven open source web engine written in the Python language. An input validation error vulnerability exists in Twisted versions prior to 19.2.1. The vulnerability stems from a network system or product that does not properly validate incoming data. An attacker can exploit the...

PYSEC-2019-58

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

UBUNTU-CVE-2019-12387

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

PYSEC-2019-113

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI...

July 24, 2018—KB4338817 (OS Build 16299.579)

None None...

GHSA-77HV-8796-8CCP HTTP header injection in Plone and Zope2

ZPublisher.HTTPRequest.scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed LF character...

CVE-2017-8788

An issue was discovered on Accellion FTA devices before FTA912180. There is a CRLF vulnerability in settingsglobaltextedit.php allowing ?display=x%0Dnewline attacks...

UBUNTU-CVE-2016-4993

CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform EAP 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

The vulnerability of WebSphere Application Server’s application servers allows attackers to inject arbitrary HTTP headers.

The vulnerability of WebSphere Application Server for application servers exists due to the lack of measures to address the CRLF sequence return with a line break. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP headers using a specially crafted URL...

The vulnerability of the Oracle Fusion Middleware software platform allows a malicious actor to inject arbitrary data into the context of a vulnerable application.

The vulnerability of the Oracle Containers component for the J2EE software platform, Oracle Fusion Middleware, is related to an error that occurs due to insufficient checking of values in HTTP headers. Exploiting this vulnerability allows a malicious actor to generate a forged HTTP response and...

CVE-2016-2303

CRLF injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

Vulnerabilities of the Debian GNU/Linux operating system, allowing attackers to inject arbitrary SMTP commands

The Debian GNU/Linux operating system has multiple vulnerabilities due to the failure to address the issue of handling CRLF sequences carriage return followed by line feed. Exploiting these vulnerabilities allows a malicious actor to inject arbitrary SMTP commands through CRLF sequences into the...