CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
107 vulnerabilities with CWE-113
CVE-2026-66753
LOW
tiny-http 0.12.0 HTTP Response Splitting via Header Injection
CVSS 3.7
CVE-2026-66746
MEDIUM
Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
CVSS 5.4
CVE-2026-63771
HIGH
Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
CVSS 7.1
CVE-2026-54163
MEDIUM
secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
CVSS 4.7
CVE-2026-50188
MEDIUM
Kirby: Request header injection in `Http\Remote`
CVE-2026-55766
MEDIUM
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
CVSS 4.8
CVE-2026-50269
HIGH
AIOHTTP: CRLF injection in multipart headers
CVSS 7.5
CVE-2026-50630
MEDIUM
Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
CVSS 6.5
CVE-2026-44489
LOW
Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
CVSS 3.7
CVE-2026-49214
MEDIUM
guzzlehttp/psr7 has CRLF Injection via URI Host Component
CVSS 5.3
CVE-2026-43966
MEDIUM
HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2
CVE-2026-48596
LOW
CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection
CVE-2026-38967
CRITICAL
CrowCpp Crow <= 1.3.1 - HTTP Response Header Injection via Unvalidated Header Values
CVSS 9.8
CVE-2026-38978
MEDIUM
Transmission <= 4.1.1 - Clickjacking in WebUI and RPC Response Paths
CVSS 5.3
CVE-2026-47675
MEDIUM
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
CVSS 4.3
CVE-2026-9658
HIGH
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths
CVSS 7.3
CVE-2026-44214
MEDIUM
eventsource-encoder: SSE event injection via unsanitized event and id fields
CVSS 5.8
CVE-2026-42578
HIGH
Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
CVSS 7.5
CVE-2026-7010
MEDIUM
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values
CVSS 6.5
CVE-2026-42874
LOW
Microdot: HTTP response splitting in Response.set_cookie()
CVSS 3.7
CVE-2026-41683
HIGH
HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header
CVSS 8.6
CVE-2026-43870
HIGH
Apache Thrift: Node.js web_server.js multi-vulnerability
CVSS 7.3
CVE-2026-42035
HIGH
Axios: Header Injection via Prototype Pollution
CVSS 7.4
CVE-2026-39971
HIGH
Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST
CVSS 7.2
CVE-2026-40175
MEDIUM
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
CVSS 4.8
Details
Vulnerabilities
107