Description
CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Ulf Harnhammar · perlremotelinux
https://www.exploit-db.com/exploits/21722
References (10)
Scores
EPSS
0.1312
EPSS Percentile
94.1%
Details
Status
published
Products (9)
elinks/elinks
0.2.4
elinks/elinks
0.3.2
links/links
0.96
university_of_kansas/lynx
2.8.2_rel1
university_of_kansas/lynx
2.8.3
university_of_kansas/lynx
2.8.3_rel1
university_of_kansas/lynx
2.8.4
university_of_kansas/lynx
2.8.4_rel1
university_of_kansas/lynx
2.8.5_dev8
Published
Feb 19, 2003
Tracked Since
Feb 18, 2026