CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

196 vulnerabilities with CWE-93
CVE-2026-44092 CRITICAL
Missing input validation / stripping of CRLF characters in SystemConfigManager
CVSS 9.1
CVE-2026-15157 MEDIUM
undici vulnerable to CRLF Injection via blob-like body 'type' property
CVSS 4.2
CVE-2026-12357 HIGH
Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability
CVSS 7.2
CVE-2026-59920 MEDIUM
Netty: STOMP CONNECT Frame Header Injection
CVSS 6.5
CVE-2026-59919 MEDIUM
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
CVSS 5.5
CVE-2026-59921 MEDIUM
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
CVSS 5.7
CVE-2026-57511 MEDIUM
SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title
CVSS 5.4
CVE-2026-16313 HIGH
Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
CVSS 7.6
CVE-2026-45070 MEDIUM
Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names
CVSS 6.5
CVE-2026-45067 MEDIUM
Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
CVE-2026-15429 MEDIUM
Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v
CVE-2026-50188 MEDIUM
Kirby: Request header injection in `Http\Remote`
CVE-2026-12127 MEDIUM
WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
CVSS 5.3
CVE-2026-57281 HIGH
Jenkins Script Security Plugin < 1402.v94c9ce464861 - Protection Mechanism Failure
CVSS 7.5
CVE-2026-55766 MEDIUM
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
CVSS 4.8
CVE-2026-55603 HIGH
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
CVSS 7.5
CVE-2026-47242 MEDIUM
Net::IMAP: Command Injection via ID command argument
CVE-2026-47240 MEDIUM
Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument
CVE-2026-50269 HIGH
AIOHTTP: CRLF injection in multipart headers
CVSS 7.5
CVE-2026-11373 CRITICAL
Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections
CVSS 9.1
CVE-2026-9679 MEDIUM
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
CVSS 5.9
CVE-2026-12143 HIGH
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
CVSS 7.5
CVE-2026-50629 MEDIUM
Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
CVSS 5.3
CVE-2026-49214 MEDIUM
guzzlehttp/psr7 has CRLF Injection via URI Host Component
CVSS 5.3
CVE-2026-50639 MEDIUM
Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections
CVSS 6.5
Details
Vulnerabilities 196
Links
MITRE CWE Entry Search this CWE With Exploits